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IDENTIFICATION SECURITY: REEVALUATING 
THE REAL ID ACT 


WEDNESDAY, JULY 15, 2009 

U.S. Senate, 

Committee on Homeland Security 
AND Government Aefairs, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:09 a.m., in room 
SD-342, Dirksen Senate Office Building, Hon. Joseph 1. Lieber- 
man. Chairman of the Committee, presiding. 

Present: Senators Lieberman, Akaka, Tester, Burris, Bennet, 
Collins, and Voinovich. 

OPENING STATEMENT OF CHAIRMAN LIEBERMAN 

Chairman Lieberman. Good morning and welcome to this hear- 
ing where we will review the steps that the U.S. Government has 
taken and State governments have responded to and those steps 
that we may ultimately take to achieve the important national goal 
of keeping fraudulent State identification cards and drivers’ li- 
censes out of the hands of terrorists and criminals. 

I want to welcome Secretary Napolitano, Governor Douglas of 
Vermont, and our witnesses on the second panel, and to thank you 
for all the work that you have done on this very important matter. 

I always kick myself when I say I told you so, but I regret to say 
that I am not surprised we are here today. When Congress adopted 
the so-called REAL ID Act of 2005 as an amendment to a supple- 
mental appropriations bill without hearings of any kind or any for- 
mal public vetting, we replaced a process for developing Federal 
identification requirements that Senator Collins and I had made 
part of the Intelligence Reform and Terrorism Prevention Act of 
2004, the so-called 9/11 Commission legislation. 

In our work. Senator Collins and I took very seriously the finding 
of the 9/11 Commission that “All but one of the 9/11 hijackers ac- 
quired some form of U.S. identification document, some by fraud. 
Acquisition of these forms of identification would have assisted 
them in boarding commercial flights, renting cars and other nec- 
essary activities.” 

And the 9/11 Commission went on to appeal to the Federal Gov- 
ernment to “set standards for the issuance of birth certificates and 
sources of identification on such as drivers’ licenses.” 

With that in mind, we therefore included in the 9/11 legislation 
of 2004 a requirement that the Federal Government establish a ne- 
gotiated rulemaking committee composed of subject matter experts 

( 1 ) 
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and stakeholders including, of course, representatives of the State 
governments to propose workable identification security standards. 

Then came the REAL ID Act of 2005, which, as I said, was sub- 
mitted as an amendment to supplemental appropriations legisla- 
tion. Though I thought some of the parts of the Act and the inten- 
tion of the Act were good, I opposed the REAL ID Act because I 
thought ultimately it laid out a very prescriptive, unworkable, and 
expensive process. And, unfortunately, history has borne this out, 
and that is why we are here today, if I may rub it in a little bit. 

I really believe that if our original 9/11 Commission legislation 
had been left intact and a rulemaking process had begun negotia- 
tions with the States and the Eederal Government, and it had not 
been repealed by REAL ID, we would have millions more secure 
IDs instead of being involved in a continuing debate and, really, a 
joust between the States and the Eederal Government. 

Some States, including Connecticut, are working to implement 
REAL ID, but the fact is that the legislatures of 13 States have 
passed laws prohibiting their States from complying with REAL ID 
as it presently stands, and several other States are right now con- 
sidering some other legislation, and that is at the risk that their 
State identification documents will not be accepted by the Eederal 
Government, for instance, for boarding a plane. 

So that is the dilemma and the crisis really that brings us here 
today as we try to answer the question of what kinds of changes 
to REAL ID are necessary to achieve a workable solution here. 

As always in the Congress, we cannot let the perfect be the 
enemy of the good, but, of course, we want to ensure that what we 
consider to be good is not diluted so that we in any way com- 
promise our homeland security. I, personally, think we can achieve 
both goals. 

Today, we are going to discuss bipartisan legislation sponsored 
by a number of Members of this Committee — Senators Akaka, 
Voinovich, Carper, Tester, and Burris — which is called the PASS 
ID Act that reforms REAL ID in an attempt to make it work as 
intended while trying to ease the strain on our overburdened and 
underfunded State governments. 

The plan retains parts of REAL ID such as the requirement of 
a digital photograph, signature, and machine-readable coding on 
State-issued ID cards. States will also need to verify an applicant’s 
Social Security number and legal status by checking Eederal immi- 
gration and Social Security databases. 

But the States would be given more flexibility in issuing the new 
identification cards while staying, I am pleased to say, within the 
REAL ID time table. In fact, if the Providing for Additional Secu- 
rity in States’ Identification (PASS ID) Act becomes law this year. 
States must be fully compliant with it before the current REAL ID 
deadline of 2017, and that is important, I am sure, to all of us be- 
cause any acceptable solution must really work within existing 
timetables and not delay increased personal identification security. 

PASS ID does eliminate a requirement that motor vehicle depart- 
ments electronically check the validity of some identity documents 
such as birth certificates with the originating agency. I know this 
change has been a major source of concern, and this morning I 
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want to discuss it with our witnesses and see if those concerns are 
justified. 

PASS ID also strengthens privacy protections by requiring proce- 
dures be put in place to prevent the unauthorized access or sharing 
of information, to require a public notice of privacy policy and a 
process for individuals to correct their records. 

So let me thank Senators Akaka, Voinovich, and others who join 
them, as well as Secretary Napolitano, for the efforts that you have 
made to come up with a plan that can work while not losing sight 
of the very direct statement of the 9/11 Commission warning us 
that “For terrorists, travel documents are as important as weap- 
ons.” 

I still do have some concerns about PASS ID that I want to ex- 
plore with our witnesses today, but, bottom line, in an age of ter- 
rorism, reliable personal identification is an important and urgent 
matter critical to our homeland security. I hope that this hearing 
will enable us to move forward and mark up legislation in this 
Committee on this matter in the very near future. 

Senator Collins. 

OPENING STATEMENT OF SENATOR COLLINS 

Senator Collins. Thank, Mr. Chairman. 

One week from today, we mark the 5th Anniversary of the re- 
lease of the bipartisan 9/11 Commission Report. In examining how 
terrorists were able to attack our country the Commission found 
that all but one of the 19 terrorists used drivers’ licenses to board 
the planes that were then used as weapons in the attacks that 
killed nearly 3,000 people. 

The commissioners recognized that easily-obtained drivers’ li- 
censes were a security vulnerability. As the Chairman has said, the 
words that I, too, remember are the Commission’s words saying 
that “For terrorists, travel documents are as important as weap- 
ons.” And to address this vulnerability, the Commission rec- 
ommended that the Federal Government set standards for the 
issuance of birth certificates and other sources of identification, 
particularly drivers’ licenses which had proven to be so vital to the 
hijackers’ ability to carry out their deadly plot. 

To call the effort to implement this recommendation “difficult” 
would be an understatement. As Senator Lieberman has recounted, 
he and I authored very well thought-out provisions in the Intel- 
ligence Reform Act of 2004 that established a collaborative com- 
mittee comprised of Federal and State officials, technology experts 
and privacy advocates to develop these secure identification stand- 
ards, and the work of this Committee was well underway in 2005 
when, regrettably, the House of Representatives repealed our provi- 
sions by slipping the REAL ID Act into an urgent war-funding bill. 

I use the word, slipping it into the urgent war-funding bill ad- 
visedly because in the Senate there were no hearings, there was no 
debate, there was no vote. This was a take it or leave it vote on 
the entire war supplemental. 

Then, for more than 2 years. States were left to contemplate the 
enormity of the task of reissuing new licenses to all drivers by May 
2008, while they waited for the Department of Homeland Security 
(DHS) to issue the regulations that would tell them how to achieve 
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that requirement. And the States waited and waited and waited 
until January 29, 2008, when a final rule was issued, leaving the 
States just 103 days until the May 11, 2008, compliance deadline. 

Complicating the problem. State budgets had little room for the 
hundreds of millions of dollars that it would cost to implement the 
new regulations, and, of course, a faltering economy only worsened 
the financial strain. 

Another problem was that the key information technology sys- 
tems necessary to implement the law efficiently were not readily 
available. 

And, although identity theft costs the economy billions of dollars 
and causes much distress to its victims, the Department’s regula- 
tions failed to address critical privacy issues created by the inter- 
connected systems of databases mandated by the law. 

With these problems unresolved and numerous States protesting 
REAL ID or even outright refusing to implement the law, I worked 
to persuade the Department to provide States with an additional 
18 months to meet the REAL ID deadline, giving us all time to re- 
visit the issues. 

The PASS ID Act that we are discussing today is one attempt to 
resolve these problems. It refines rather than repeals the law, and 
it targets areas where the law imposed unreasonable and costly 
burdens, failed to protect the privacy interests of our citizens and 
mandated technological solutions that may not be practical. 

One example of these refinements is in the bill’s approach to en- 
suring that each person possess only one valid license, from any 
one State, at any one time. To meet this goal, REAL ID would have 
mandated an information sharing system that may not be tech- 
nically feasible or governed by basic privacy protections. Instead of 
scrapping the system altogether, PASS ID would preserve and fund 
a pilot program to test the necessary technology and to permit a 
careful examination of privacy concerns. This makes a great deal 
of sense. 

Nonetheless, I recognize the concerns of those who fear that this 
bill, in addressing the problems of REAL ID, may have unintended 
consequences. Drivers’ licenses can be the keys to the kingdom for 
terrorists bent on death and destruction. States have a responsi- 
bility to ensure that licenses are tamper-proof and issued only to 
people whose identity and legal status can be verified. 

Certain language in the PASS ID Act may undermine that goal 
because it would not allow the Transportation Security Administra- 
tion (TSA) to prevent a passenger from boarding a plane based 
solely on the fact that he or she did not have a compliant license. 
This provision would eliminate an important incentive for States to 
adopt Federal standards and could impose worrisome restrictions 
on the discretion of security officials who believe a passenger with- 
out a compliant license should not be permitted to board a plane. 

As we examine this legislation today, my primary concerns are 
whether these provisions are moving us toward the security goal 
set by the 9/11 Commission 5 years ago while accommodating the 
legitimate concerns of States and privacy experts. 

Thank you, Mr. Chairman. 

Chairman LlEBERMAN. Thank you very much. Senator Collins. 


VerDate Nov 24 2008 


09:40 Jun 06, 2011 Jkt 51792 PO 00000 Frm 000008 Fmt 06633 Sfmt 06633 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



5 


It seems appropriate to move slightly away from normal Com- 
mittee procedures and to invite Senator Akaka and Senator 
Voinovich to make an opening statement, if they would like, based 
on the extensive work that they have done in preparing and intro- 
ducing PASS ID. 

Senator Akaka. 

OPENING STATEMENT OF SENATOR AKAKA 

Senator Akaka. Thank you very much, Mr. Chairman. I want to 
thank you for holding this hearing to further explore the ramifica- 
tions REAL ID on States, on security, and on privacy as well as 
the proposal that I, along with Senators Voinovich, Carper, Tester, 
Burris and other Members, have put forward to fix REAL ID. 

At this point, Mr. Chairman, may I add happy birthday to our 
friend here. Senator Voinovich. 

Chairman LlEBERMAN. Happy birthday. 

Senator Collins. Happy birthday. 

Senator Akaka. I have been a longtime opponent of REAL ID 
due to concerns about protecting individuals’ privacy as well as the 
States’ inability to implement the burdensome program. REAL ID 
calls on the States to collect and electronically store individuals’ 
personal records when issuing licenses and to share that informa- 
tion with every department of motor vehicles (DMV) nationwide. 
This effectively would create a national database containing mas- 
sive amounts of personal information. 

During the last Congress, I chaired two hearings on REAL ID 
where it became clear that it was simply not workable. Some of the 
data systems do not yet exist because so many States have balked 
at the high costs and privacy implications of creating such a sys- 
tem. If REAL ID is implemented, these databases could provide 
one-stop shopping for identity thieves and become the backbone for 
a national identification card. 

We must act to fix REAL ID. States simply still cannot afford the 
$4 billion it would take to implement REAL ID. Over a dozen 
States have already refused to comply, and several more, like Ha- 
waii, have expressed serious concerns with the program. Without 
the participation of all States, there will be only a patchwork sys- 
tem for identification security, which means no real security at all. 

The bill I am proposing, S. 1261, ^ the Providing for Additional 
Security in States’ Identification Act of 2009, or PASS ID Act, rep- 
resents a pragmatic approach to resolving many of the most trou- 
bling aspects of the REAL ID Act. I worked closely with the stake- 
holders, many of whom are here today, representing a broad range 
of views, to develop this practical alternative to REAL ID. 

The PASS ID Act does exactly what the 9/11 Commission rec- 
ommended: It sets strong security standards for the issuance of 
identification cards and drivers’ licenses. 

What it does not do is go far beyond that recommendation by re- 
quiring the collection of Americans’ personal information and stor- 
ing it in a centralized repository accessible by any State DMV. 

Perhaps the most important change in our bill is the removal of 
the mandate that States share all of their drivers’ license data with 


^The bill (S. 1261) referenced by Senator Akaka appears in the Appendix on page 55. 
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each of the other States. This provision created a clear threat to 
the privacy of all Americans’ personal information, posed a great 
risk for identity theft and fraud, and raised the specter of a na- 
tional database of all Americans’ personal information. 

The bill requires States to protect electronic information and, for 
the first time, any machine readable data stored on identification 
cards and drivers’ licenses themselves, ensuring it is only used for 
its intended purposes. 

Another change I want to highlight is the clarification of Ameri- 
cans’ right to travel on commercial aircraft and to enter Federal 
buildings. The current law restricts these rights by requiring a 
REAL ID-compliant ID to board commercial aircraft and to enter 
Federal buildings. 

In this country, we cherish the right to travel and the right to 
petition the government. Americans should not be denied boarding 
an aircraft or denied entry to most Federal buildings solely because 
they have lost or do not have their identification. Instead, such sit- 
uations should be resolved through additional security screening or 
other inquiries as needed, as is currently TSA policy and is the 
case with every other type of security risk. 

As important as what would change with PASS ID is what would 
not change: Individuals would still need to prove that they are law- 
fully present in the United States; individuals would only be al- 
lowed one compliant identification to be used for official purposes; 
and individuals would need to present the same sources of identi- 
fying documents to obtain a compliant license. 

This compromise bill does not address all of my concerns with 
REAL ID. I know that others are disappointed that it does not ad- 
dress all of their concerns. However, the reality we face right now 
is that in less than a year States will be required to comply with 
a law that is overly burdensome and unworkable. We cannot let 
the perfect be the enemy of the good, especially when we are work- 
ing to address a seriously flawed law already on the books. 

To date, the Department of Homeland Security, the National 
Governors Association, National Conference of State Legislatures, 
the Center for Democracy and Technology, and several law enforce- 
ment organizations have endorsed PASS ID. I hope we will move 
swiftly to ensure its enactment and provide some clarity to States 
facing REAL ID implementation deadlines. 

As always, my goal remains to protect both the security needs 
and the privacy rights of all Americans, and I will continue to work 
closely with the Department of Homeland Security to ensure that 
individual rights and liberties are fully protected during the imple- 
mentation of PASS ID. 

I thank you again. Chairman Lieberman and Ranking Member 
Collins, for agreeing to hold this hearing. 

I ask that my full statement from the introduction of PASS ID 
be included in this hearing’s record. ^ 

Chairman Lieberman. Thanks, Senator Akaka. Without objec- 
tion, so ordered. 

Happy birthday. Senator Voinovich. I do not know your age, but 
I am prepared to say that you look younger than you are. 


^The statement referenced by Senator Akaka appears in the Appendix on page 52. 
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Senator VOINOVICH. I will hire you for public relations. [Laugh- 
ter.] 

Chairman LlEBERMAN. I bet I am right, but you do not have to 
disclose anything here. 

OPENING STATEMENT OF SENATOR VOINOVICH 

Senator VoiNOViCH. I have a problem because I have to do an 
amendment in a committee, and I have just been told I have to get 
up there for it. So I will make this really brief. 

First of all. Senator Akaka, thank you very much for all the work 
that you have put in on this bill. We have some great co-sponsors 
of this legislation. You have spoken eloquently to this, but what ev- 
eryone ought to understand is that REAL ID, 5 years later after 
enactment has not been implemented. It is not implemented. 

Why did it not get implemented? It is because Congress did not 
sit down with the people that were impacted by the legislation and 
get their thoughts on how we could go about making these require- 
ments possible. 

And I will never forget when we had the hearing last year and 
Senator Akaka said we have to stop, throw it all out, begin again, 
get everybody involved, and do it right. And that is exactly what 
we have done. 

Madam Secretary, thank you very much, and the National Gov- 
ernors Association too. You have come together, figured out how we 
can get this done and set Federal requirements working together. 
We have a symbiotic relationship. We want to secure America. But 
the way we do that is by working together, and that is exactly 
what this legislation, I think, accomplishes. 

Now there may be some things yet that need to be added to it. 
But it is a good lesson for this Committee and for Congress. It is 
that when you go out and you do not dot the Fs, cross the T’s, and 
spend the time with the people that are really involved with an 
issue, what happens is it does not work. 

And then what happens? You have to start all over again. So 
why not do it right the first time? 

So we are going to do it right the second time. Thank you. 

Chairman LlEBERMAN. Hear, hear. Thank you. 

Thanks, Secretary Napolitano and Governor Douglas for being 
here, for your patience while we did the opening statements. Now 
I am happy to call on our Secretary of Homeland Security, Janet 
Napolitano. 

STATEMENT OF HON. JANET A. NAPOLITANO/ SECRETARY, 
U.S. DEPARTMENT OF HOMELAND SECURITY 

Secretary Napolitano. Thank you, Mr. Chairman, Senator Col- 
lins, Members of the Committee, for the opportunity to testify on 
PASS ID. I have a longer statement that I ask be included in the 
record. 

Chairman LlEBERMAN. Without objection. 

Secretary Napolitano. PASS ID is a bill that I support. The De- 
partment of Homeland Security (DHS) worked with governors and 
other stakeholders to provide technical assistance in its drafting. 


^The prepared statement of Secretary Napolitano appears in the Appendix on page 82. 
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and so the approach that PASS ID takes to fix REAL ID is one that 
I support, and I think it makes sense. 

This is an important piece of national security legislation that is 
designed to help fulfill the 9/11 Commission’s recommendation that 
the Federal Government set security standards for drivers’ licenses. 
As has already been commented upon, the first attempt to do this, 
the REAL ID Act, was a start that badly needs to be fixed. PASS 
ID is a fix for REAL ID. 

The States agree that REAL ID is too rigid and needlessly expen- 
sive in mandating how States meet their security goals. As you 
noted. Chairman Lieberman, 13 States — I think Missouri being the 
most recent last night — have actually enacted legislation barring 
themselves from implementing REAL ID, and 13 other States have 
passed resolutions opposing REAL ID. We cannot have national 
standards for drivers’ licenses when the States themselves refuse 
to participate. 

Now the practical problem with REAL ID is one of timeliness, 
and that sets the urgency for PASS ID because under REAL ID, 
as of December 31 of this year. States are required to attest that 
they are implementing REAL ID for their drivers’ licenses so that 
they can be accepted for things like boarding a plane. By December 
31 of this year, no State will have issued a REAL ID-compliant 
identification document. No State will have a REAL ID -compliant 
document. 

Chairman Lieberman. So, if I may interrupt you, that means 
that assuming nothing else happens in between, that it is under 
the law the drivers’ licenses issued by the States would not be ac- 
cepted by TSA to gain passage onto airplanes? 

Secretary Napolitano. That is correct, Mr. Chairman, not with- 
out additional screening by TSA, and one can only contemplate just 
the inconvenience in airline travel that could occur if everyone has 
to undergo additional screening because they do not have a REAL 
ID-compliant drivers’ license. 

Chairman Lieberman. In other words, the kind of secondary 
screening that goes on now, if for some reason you forget your li- 
cense or something of that kind, that would have to happen to ev- 
erybody? 

Secretary Napolitano. That is right. Senator. 

Chairman Lieberman. Interesting. 

Secretary Napolitano. So that sets the urgency for REAL ID 
and why I am so appreciative of PASS ID, why I am so appre- 
ciative that the Committee scheduled this hearing today and is 
moving forward. 

I am very pleased to be sitting next to Jim Douglas, my good 
friend, the Republican Governor of Vermont. He is the incoming 
Chair of the National Governors Association. 

Later, you will hear from Sheriff Leroy Baca of Los Angeles on 
why law enforcement supports PASS ID. 

Now we get to the fundamental reason why we have these laws 
in the first place. We go back to the 9/11 Commission Report. We 
need secure identification to thwart potential terrorists. Law en- 
forcement needs to have confidence that an ID holder is who he or 
she claims to be. As the 9/11 Commission Report said, to terrorists, 
travel documents are just as important as weapons. 
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States vary widely in the standards they employ. Now the sys- 
tem is too open to fraud. National standards are necessary, but na- 
tional standards are embodied both in REAL ID and in PASS ID. 
Secure identification certainly will not thwart every planned ter- 
rorist attack, but it can present an obstacle and given another 
counterterrorism tool to law enforcement that we need. 

Now, as has been mentioned, there are many similarities be- 
tween REAL ID and PASS ID. The main similarities between the 
two are the requirements for physical security of drivers’ license 
production. The premises must be secure. A background check on 
employees must be conducted. There must be fraudulent document 
training given to all employees involved in the process. 

A requirement to show PASS ID: At the end of the implementa- 
tion period, noncompliant identifications would no longer be auto- 
matically accepted to board planes, enter nuclear plants, govern- 
ment buildings, and the like. 

Document validation: Both laws would require States to validate 
the legitimacy of the underlying source documents such as birth 
certificates or licenses from other States. Eurther, under PASS ID, 
the requirement for electronic verification of Social Security num- 
bers and lawful status remains. 

Now the differences: Why is this easier to implement from the 
State perspective? 

Eirst, PASS ID eliminates the blanket requirement to use untest- 
ed technologies for electronic verification of any and all source doc- 
uments. States still have to validate documents, but they can pur- 
sue different ways to reach that standard. 

Second, they are required to electronically verify the Social Secu- 
rity and lawful presence through the Social Security Online Verifi- 
cation (SSOLV) and Systematic Alien Verification for Entitlements 
(SAVE) databases. But unlike REAL ID, under PASS ID, they are 
exempted from paying the fee for doing those checks. 

Third, there is greater flexibility under PASS ID in terms of how 
you re-enroll existing drivers’ license holders because under REAL 
ID you have to re-enroll everybody under the age of 50, 3 years ear- 
lier than everybody else. Under PASS ID, we give the States flexi- 
bility on how to do the re-enrollment so long as everything is com- 
plete by 2016, which actually is one year earlier than the final com- 
pletion date for REAL ID. 

And, last, in terms of differences, as has been noted by Senator 
Akaka, unlike REAL ID, PASS ID actually contains within it spe- 
cific assurance that States and privacy advocates have sought for 
the protection of the information that is garnered in the process. 

So these differences which are designed to make the goal of 
REAL ID a reachable goal and designed to move us toward reach- 
ing the goal of the 9/11 Commission Report, these differences con- 
tained within PASS ID make it a bill that, if passed and imple- 
mented before the December 31 deadline of this year, will fix a bill 
that was flawed from the outset. 

Thank you, Mr. Chairman. 

Chairman LiEBERMAN. Thanks, Madam Secretary. That was very 
helpful testimony. 

Governor Douglas, we are honored to have you. You are here ob- 
viously not only in your capacity as the Governor of Vermont but 


VerDate Nov 24 2008 


09:40 Jun 06, 2011 Jkt51792 PO 00000 Frm000013 Fmt 06633 Sfmt 06633 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



10 


as the incoming Chairman of the National Governors Association 
(NGA) which has endorsed PASS ID. Good morning. 

STATEMENT OF HON. JIM DOUGLASP GOVERNOR, STATE OF 
VERMONT; VICE CHAIR, NATIONAL GOVERNORS ASSOCIATION 

Governor Douglas. Well, thank you, Mr. Chairman, very much 
for your time today. It is great to be here, and I want to thank you 
for scheduling the hearing and for choosing the appropriate title, 
which is Reevaluating the REAL ID Act, because that is certainly 
what we need to do. We need to reevaluate it because it is not 
working. We have to come up with some solutions that will help 
us accomplish its goals. 

For the past several years, at our NGA meetings, as the Sec- 
retary knows well, we have been talking about this, and all of the 
conversations seem to end the same way, with a great deal of frus- 
tration. Governors are frustrated because every governor is a secu- 
rity governor. 

Every governor wants his or her State to issue licenses that are 
accurate and secure. Every governor wants government to work. 
Every governor is vividly aware of what happened on September 
11, 2001, and wants to do what he or she can to make sure that 
it does not happen again. 

As you noted, Mr. Chairman, in your opening comments and Sen- 
ator Collins did as well, the two of you crafted a negotiated rule- 
making process as part of the Intelligence Reform Act that was de- 
signed to bring all the parties to the table to craft meaningful na- 
tional standards for drivers’ licenses. Ironically, if that agreement 
had been left in place, we probably would not be having this discus- 
sion today. But, instead, the negotiated rulemaking was replaced, 
as you have noted, by REAL ID. 

As of yesterday, 13 States have enacted laws prohibiting its im- 
plementation, and a number of others have adopted joint resolu- 
tions opposing the law. Well, it seems to me that security systems 
only work if people are willing to use them. REAL ID does not 
work because a lot of States have just said no. 

So I am committed to providing Vermonters with a driver’s li- 
cense that is accurate and secure, and I know my colleagues are 
in their State as well. But, while the objectives of REAL ID are 
laudable, the law represents an unworkable and unfunded man- 
date that fails to make us more secure. I really believe we need a 
better mousetrap. 

PASS ID provides a solution and a path forward, and I want to 
thank Senator Akaka and Senator Voinovich and their colleagues 
for introducing it. 

PASS ID builds on the strengths of REAL ID. It solves its weak- 
nesses and delivers more cost-effective common-sense solutions 
that can enhance the security and integrity of all licenses and 
State identification cards. 

PASS ID is consistent with the 9/11 Commission recommenda- 
tion that has been cited. It increased security. It facilitates partici- 
pation by all jurisdictions. And it addresses one of the largest con- 


^The prepared statement of Governor Douglas appears in the Appendix on page 91. 


VerDate Nov 24 2008 09:40 Jun 06, 201 1 Jkt 51792 PO 00000 Frm 000014 Fmt 06633 Sfmt 06633 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



11 


cerns with REAL ID: how to allow States with anti-REAL ID laws 
to come into compliance with a workable national standard. 

The PASS ID Act was written as the original act should have 
been, with States, the Homeland Security Department, and other 
interested groups at the table. That is why NGA supports this pro- 
posal. That is why I am happy to join my former colleague, herself 
a former Chair of NGA, Secretary Napolitano, and offer my en- 
dorsement of the bill. 

We fully understand the need to ensure the integrity of security 
and security of the process by which we issue drivers’ licenses and 
ID cards in my State. We are working toward compliance with the 
law. I want to assure the Committee that we are one of the states 
that is not resisting. We are doing everything we can to comply, 
but, as enacted, REAL ID poses significant challenges for imple- 
mentation. 

Now PASS ID will also present some real challenges, some 
changes at least in the way we issue licenses, but its elimination 
of unnecessary requirements and its cost-effectiveness make it a 
much better alternative. 

There are significant challenges in developing the electronic sys- 
tems that REAL ID requires as some of you have noted and, frank- 
ly, a great deal of doubt about whether they are going to be ready 
on time, whether they will be reliable, and whether they will be na- 
tionally deployed so that we can begin issuing fully compliant li- 
censes by the deadline. 

In contrast, our State’s processes for validating documents like 
birth certificates and ensuring only one license per driver are rig- 
orous and reliable. In Vermont, we feel we can achieve the same 
level of security called for in REAL ID and do it sooner under 
PASS ID. 

It is most cost-effective — the key consideration, especially in 
these difficult fiscal times. The present cost estimate for States to 
implement REAL ID nationally is $3.9 billion. In Vermont, we esti- 
mate it will cost us at least $20 million, which is a lot for a State 
our size and a real roadblock to its implementation. 

Vermont has not completed a detailed cost analysis of PASS ID, 
but it is clear that it eliminates unnecessary costs and authorizes 
some of the funding necessary for States to implement the pro- 
gram, and that is an important first step toward covering the cost 
of compliance. 

PASS ID eliminates unnecessary costs like the transaction 
charges for linking to and using the Eederal system. It authorizes 
some of the funding necessary to implement the program. These 
are big steps toward covering those costs. In fact, the NGA, with 
the assistance of State stakeholders, estimates that PASS ID would 
cost States about $2 billion, approximately half of REAL ID. 

In addition, PASS ID strengthens privacy protections. It requires 
privacy and security protections for the personal identification that 
is collected and stored in databases for the program. It requires 
States to establish safeguards against unauthorized access and use 
of such information as well as to create a process for cardholders 
to access and correct their own information if they find an error. 

One aspect of PASS ID that we particularly appreciate is the 
bill’s explicit recognition of the Enhanced Driver’s Licenses. Since 
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we are so close to the Canadian province of Quebec, we very much 
value the importance of having an open but secure border. 

I have my Enhanced Driver’s License, Mr. Chairman, and I have 
already used it in returning to Vermont from across the Canadian 
border. It is convenient. It is faster, and I appreciate the work of 
the Homeland Security Department in facilitating our approval of 
this document. 

Just do not look at the weight. Secretary Napolitano. I am not 
under oath on that. [Laughter.] 

Vermont businesses retain jobs and grow because of opportuni- 
ties to sell products and services to our neighbors to the north. The 
United States and Canada enjoy the largest bilateral trading rela- 
tionship in the world with more than $1.3 billion in goods and serv- 
ices crossing the border every day. 

Thousands of people in my State cross the border with Quebec 
every day. Our border station at Derby Line is one of the busiest 
on the Canadian border for commercial truck traffic. In today’s eco- 
nomic climate, a free and open border for Vermont manufacturers 
and retail businesses is more crucial than ever. 

The importance of our Enhanced Driver’s License (EDL) being 
recognized as compliant with Federal driver’s license standards 
cannot be understated. Our economic, environmental, and cultural 
relationship with Quebec is of paramount importance. The EDL 
costs us about a million dollars to implement, but, more impor- 
tantly, the ease of border travel that it allows is key to our econ- 
omy and our relationship with Canada, our largest trading partner. 

Now since the passage of REAL ID, governors have consistently 
offered constructive suggestions for implementing it. We have en- 
courage DHS and Congress to fix the Act by implementing statu- 
tory or regulatory changes to make it feasible and cost-effective. 
We have called on the Federal Government to fund it by providing 
support to offset our State expenditures for meeting Federal stand- 
ards. 

I really believe that PASS ID represents the kind of common- 
sense solution that governors have long sought. PASS ID rep- 
resents, in contrast with REAL ID, a workable, cost-effective solu- 
tion that can increase the security and integrity of all license and 
identification systems. 

I want to highlight the critical deadline that is facing us at the 
end of this year. By December 31, all States must meet 18 specific 
requirements to be deemed materially compliant with REAL ID. 
With a quarter of States legally prohibited from meeting these re- 
quirements and almost every State, if not literally every State, as 
the Secretary noted, unlikely to achieve compliance by year-end, we 
really need to address these challenges if we are going to continue 
to have the kind of access to our borders and to our transportation 
infrastructure that we all seek. So I urge your support for passage 
of this legislation. 

I want to thank you for the opportunity to appear on behalf of 
the Nation’s governors, and I look forward to continuing to work 
with the Committee to address any issues that may remain. 

Chairman LlEBERMAN. Thanks very much. Governor Douglas. 

We will start with a 7-minute round of questions for the Sen- 
ators. 
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While we are on that subject of Enhanced Driver’s License, for 
those who do not live in States that have them, how do you use 
them? Just give us a quick report on how you get across the border 
and back? 

Governor Douglas. As you pull up to the border, roll down the 
window, and there is a screen that is very close to the driver’s side 
of the vehicle, similar to ordering something at a fast food res- 
taurant. 

Chairman LiEBERMAN. Yes. 

Governor Douglas. And you hold the card right up to the screen, 
and then the information goes to the border agent in the border 
station so that he or she has that readily available without having 
to take it off the document manually which is what happens now. 

There have been some concerns about the security of these docu- 
ments, and we provide little security envelopes that make sure that 
they cannot be read if people are concerned about it. But it is that 
easy. 

Chairman LiEBERMAN. And it is quick? 

Governor Douglas. Absolutely. 

Chairman LiEBERMAN. Thanks. 

I mentioned in my opening statement that I was grateful for the 
work that has been done by the two of you and a lot of others in- 
cluding Senators Akaka, Voinovich, and their co-sponsors here, but 
that I had some continuing concerns, and I want to ask you a ques- 
tion or two about those. 

I worry that the identity verification procedures may have been 
weakened — I know I have heard that from some critics of the PASS 
ID — and that we will wind up where none of us want to be, which 
is back where we were before September 11, 2001, when State au- 
thorities could accept an identity document without checking the 
validity. In other words, the license itself would be valid, but the 
identity documents on which it was based were not. And, as we 
know, a number of the September 11, 2001, terrorists used falsified 
source documents to get valid State IDs that allowed them to travel 
in and out of the United States. 

So the question is if PASS ID becomes law, will the next group 
of terrorists planning an attack on the United States be able to 
evade our laws in that same way. Secretary? 

Secretary Napolitano. Mr. Chairman, let me respond at several 
levels. One is because the States by and large are not imple- 
menting REAL ID you cannot assume that it sets a higher security 
standard for breeder documents than PASS ID because REAL ID, 
in a way, is dead on arrival. I mean it is just not being done, as 
Governor Douglas said, by so many States. 

I do want to clarify a statement I made earlier in our colloquy, 
which is to say it is absolutely true that no State by December 31 
will have a REAL ID-compliant document. 

Chairman LiEBERMAN. Right. 

Secretary Napolitano. The only exception will be if a State 
comes to me and certifies that they are ready or willing to comply 
with REAL ID and are making material progress to comply. 

Chairman LiEBERMAN. Such as Vermont? 

Secretary Napolitano. Perhaps. 

Chairman LiEBERMAN. Maybe. You retain discretion. [Laughter.] 
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Secretary Napolitano. Nonetheless, they still would not have a 
REAL ID-compliant document. They would just be able to get an 
extension. 

Chairman LiEBERMAN. Yes. 

Secretary Napolitano. You have 12 States covering 40 million 
people plus now Missouri, which is another 6 million, that are actu- 
ally barred from even seeking such an extension. So it gives you 
a sense of the problem. 

Chairman LiEBERMAN. Right. 

Secretary Napolitano. Going back to your question. States are 
still required to validate the breeder document. There are a variety 
of ways that States can do that, and we can give you greater detail 
on that, but they still must validate the underlying documents. 

Chairman LiEBERMAN. Under PASS ID, if PASS ID should pass. 

Secretary Napolitano. Under PASS ID, yes, Mr. Chairman. 

Second, they are required to electronically verify the Social Secu- 
rity number and lawful status with the Federal databases we have 
for those. 

Chairman LiEBERMAN. Excuse me for interrupting. That would 
be with the Social Security Administration and with Immigration? 

Secretary Napolitano. Immigration, correct. So that is added. 
The difference is that we do not charge the States a fee for requir- 
ing that they do that verification. 

The third thing is, and this is a difference from the pre-Sep- 
tember 11, 2001, world, your drivers’ license can only be issued for 
a time period that is consistent with your immigration status. 

In other words, let’s say you have a visa that will permit you to 
be in the United States for 4 years. A normal drivers’ license period 
is 7 years. Your drivers’ license can only be issued for the period 
that your lawful status is established. That difference would have 
picked up some of the September 11, 2001, hijackers. 

Chairman LiEBERMAN. OK. That is helpful. 

Let me ask you the second part of this, and then I will ask Gov- 
ernor Douglas to get into this. There is also concern about elimi- 
nating the provision in REAL ID that mandates information-shar- 
ing among States and transfers it through the PASS ID legislation 
to a voluntary pilot program. 

As you know, the September 11, 2001, hijackers held multiple 
drivers’ licenses and IDs from multiple States. Of course, it is not 
just terrorists but drug runners, counterfeiters, other criminals, 
even bad drivers with multiple offenses, like DUIs, can exploit this 
lack of information-sharing between States. In other words, they 
have a license in one or more States — that may be a problem — and 
they exploit the failure to share information between the States to 
help them hide from law enforcement. 

So tell us about why this change was made and why not compel 
information-sharing among the States just to avoid this loophole? 

Governor, do you want to start? 

Governor Douglas. Well, I think, as some of you said in your 
opening statements, there is a great deal of concern about the pro- 
tection of personal privacy as we consider these issues and a lot of 
concern in the REAL ID legislation about this national sharing 
database among all of the States. And so, with so many States de- 
clining to comply and with concerns about the flow of information 
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around the country, the proposal under PASS ID to have a pilot 
program, I think, makes some sense. 

Chairman LlEBERMAN. Is the privacy concern just expressed ex- 
plicitly that the more people who have access to more data, the 
more possibility there is of violations of privacy rights? 

Governor Douglas. I think that is exactly right. 

There are a lot of concerns that come up in various contexts, as 
you certainly know, with respect to privacy. I did not believe, for 
example, that there was really a need for a privacy sleeve on our 
Enhanced Driver’s License, but to satisfy the concerns of those who 
wonder if somehow information can be electronically captured, we 
make them available. And I think there are some concerns that 
may not be well founded but are there. So what we are tp^ing to 
find is that right middle ground between access to information that 
is necessary and respecting the rights of privacy of the American 
people. 

Chairman LlEBERMAN. This is a classic example in this post-Sep- 
tember 11, 2001, world of our responsibility to weigh those privacy 
concerns against what I would assume was the advantage to our 
national security from mandating information-sharing among the 
States about whether the individual coming in for a drivers’ license 
has had a license in another State that has been compromised. 

I presume there is also a cost concern here or is there not. Sec- 
retary? 

Secretary Napolitano. Mr. Chairman, yes, there is a significant 
cost concern. This is where the concept that there would actually 
be some big centralized hub that would have to be created that 
somehow the States would have to pay arose, and the issues with 
privacy and the ease of infiltration of a hub if there is one place 
where all the information is gathered. 

The technical feasibility of some of these systems also needs to 
be explored. From what you watch on television, you would assume 
that all these things can happen with a snap of a finger, but in fact 
technically some of these things are very difficult. 

That is why under PASS ID, we continue with what I call the 
Mississippi Pilot Project, which has several States participating, 
because as we move forward there may indeed be cost-effective so- 
lutions to some of those issues that have been raised by the States. 
But, as we stand right now, we really do not have the capacity to 
say that we are going to have in one place easy electronic 
verification of every type of license and document. 

Chairman LlEBERMAN. I thank you. My time is up. 

I would like to work with you and my colleagues on the Com- 
mittee to see if there is some way we can strengthen this section 
of the PASS ID without going over the tipping point where we con- 
tinue to encourage the States not to comply because we obviously 
need them to comply. 

Senator Collins. 

Senator Collins. Thank you, Mr. Chairman. Governor, all of us 
are concerned about the looming deadline under the current law 
and the ability of States to comply with the law. 

Under the previous Administration and, indeed, in the current 
regulations, there is a material compliance standard that the De- 
partment of Homeland Security uses to assess whether or not a 


VerDate Nov 24 2008 09:40 Jun 06, 201 1 Jkt 51792 PO 00000 Frm 000019 Fmt 06633 Sfmt 06633 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



16 


State is complying with REAL ID. I remember very distinctly Sec- 
retary Chertoff telling me that Vermont was an example of a State 
that is in material compliance with REAL ID, and he pointed to 
your Enhanced Driver’s License as an example of a compliant driv- 
ers’ license. He also cited Washington State, New York, and Michi- 
gan as being in material compliance. 

So, therefore, I am very surprised to hear Secretary Napolitano 
assert this morning that no State is in compliance with REAL ID. 
So I first want to ask you. Governor, do you consider Vermont to 
be in material compliance with REAL ID? 

Governor Douglas. I do at this point, but on December 31, there 
are 18 benchmarks that States have to meet, and even a State like 
mine that is doing its best to comply is not going to be able to meet 
all of these 18 benchmarks on that date because of the requirement 
for the national databases that are not yet up and running. So, 
now we are, but we are going to find it virtually impossible to meet 
all these 18 benchmarks by the end of the year. So that is why the 
urgency that the Secretary noted is critical. 

Senator Collins. Which is an excellent point, and it is the rea- 
son that we have gathered here today, but I do not want to leave 
the impression that there has been no progress in this area, that 
States are completely unable to make improvements in their secu- 
rity when virtually every State has taken steps, including my State 
of Maine, to make sure that we are giving licenses only to people 
who are lawfully in this country. 

My State was one that did not have that requirement. We had, 
for example, some people who were here illegally, coming to Maine, 
renting a post office box and being able to get a drivers’ license, 
and that obviously is fraught with problems. 

Secretary Napolitano, I want to ask you about a provision in 
PASS ID that you and I have discussed that I find troubling, and 
that is the provision that says that an individual cannot be prohib- 
ited from boarding an airplane solely because of the lack of a com- 
pliant drivers’ license. A strong incentive for States to comply with 
the law has been the fact that they want to avoid problems for 
their residents in boarding airplanes, yet this bill would appear to 
undermine that incentive by including specific language that pro- 
hibits Eederal security officials at airports from denying a pas- 
senger access to a plane solely on that basis. 

Now I want to make clear that the Transportation Security Ad- 
ministration (TSA) has always had the discretion to exercise judg- 
ment if an individual shows up at the airport without sufficient 
identification. They do that every day now. But that is very dif- 
ferent from putting specific language in the law that tells States 
that they are not going to be inconveniencing their residents as 
much, at least if they do not have a compliant ID, and I find that 
troubling. 

Do you support that provision? 

Secretary Napolitano. Senator, I think what would happen 
under that provision is basically the same as what would happen 
without that provision. In other words, TSA’s operating procedure 
would be that if someone appeared without a REAL ID-compliant 
document they would be subjected to additional screening, so that 
it would not be an automatic you cannot board. It is just the same 
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as you described it, but they would have to be looked at or other 
things would have to be evaluated by the TSA employee to ascer- 
tain whether they should be allowed to board. 

Senator Collins. Do you think that language should be in the 
bill? 

Secretary Napolitano. We would be happy to work with you on 
that language. 

Senator Collins. Are you concerned that the provision could be- 
come the basis of lawsuits challenging the decisions of security offi- 
cials under that standard? 

Here is the issue. Let’s say the individual does not have the com- 
pliant ID. There is a law that says that this cannot be the basis 
for keeping the individual off the airplane. Secondary screening is 
done. It finds nothing, but the security official still believes that in- 
dividual should not board the plane. 

I think you are creating a situation where that security official 
is going to feel he or she has no choice but to let the individual 
board the plane because you have now put that specific language 
in the bill, in the law. 

Secretary Napolitano. Senator, yes, I think there may be a 
point there that we can explore with you between now and markup 
of the bill, but I want to go back to the fact that with the language 
or without the language, the guidance from TSA is going to be if 
you appear without a REAL ID-compliant document some addi- 
tional exploration is going to be needed to be done before you are 
allowed to board a plane. 

Senator Collins. Mr. Chairman, I hope this is an issue at which 
we will look further. I support many of the provisions of PASS ID, 
and I commend all of those, including my own staff, who have 
worked so hard to come up with a system that is less expensive, 
less burdensome to the States, and more protective of privacy con- 
cerns. But I do want to make sure that we are not creating unin- 
tended consequences that get us back to the terrible situation that 
we had prior to September 11, 2001. 

Thank you, Mr. Chairman. 

Chairman LlEBERMAN. Thank you. Senator Collins. I share your 
concerns, and we will make sure they are reflected in our markup. 

Senator Akaka. 

Senator Akaka. Thank you very much, Mr. Chairman. 

Secretary Napolitano, as you well know through your previous 
role as the Governor of Arizona, in 2007, DHS issued all States an 
extension for complying to the REAL ID Act. As you testified, DHS 
also announced that it would grant States another extension but 
only if they proved they meet 18 REAL ID benchmarks by Decem- 
ber 31, 2009, and this was raised by the Governor. 

Many States, home to millions of people, may not meet this dead- 
line. What will DHS do if Congress does not act this year? Would 
you expect to begin enforcing your travel and facilities restrictions 
next year or to issue another extension for compliance? 

Secretary Napolitano. Senator Akaka, you have just described 
the paradigm of being between a rock in a hard place because we 
will be faced with either not enforcing a law that Congress has 
passed so that millions of Americans are not prevented from trav- 
eling, entering courthouses, or the like, or at least highly inconven- 
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ienced before they can do that, versus enforcing it and causing all 
of those effects. 

In my view, that is why we need PASS ID but more than that. 
If all I do is basically enact another universal extension, we are not 
getting to where we need to be because the whole goal here is to 
begin reaching the goal of the 9/11 Commission, which is to have 
a secure form of ID. So, if the law on the books is one that for all 
the reasons described earlier just has to be continually extended, 
we are not actually getting to a system that reaches the security 
goal that we are striving for. 

So, with a better law, we will be better able to enforce and get 
to the standard that we want to reach. 

Senator Akaka. Thank you. I know it is difficult, but thank you 
for your response. 

Governor Douglas, as you know, one of the biggest problems for 
States implementing the REAL ID Act has been inadequate fund- 
ing. States simply cannot afford to foot the bill for a $4 billion un- 
funded mandate in this economic climate. DHS has issued grants 
to States to offset some of these costs and has allowed States to use 
part of their State Homeland Security Grant Program funds which 
are required for other pressing security needs. 

Mr. Baker’s written testimony for the next panel states that the 
Federal Government should insist that States give highest priority 
to drivers’ license security rather than State-level homeland secu- 
rity priorities. 

Would you like to address from your experience, as a governor, 
the financial burdens REAL ID, in its current form, imposes on 
States and whether States are properly prioritizing their Homeland 
Security Grant funds? 

Governor Douglas. Well, I feel good about the prioritization in 
Vermont. You may want to ask other States to respond to that. 

There obviously is a great deal of accountability when we receive 
those Homeland Security resources. We believe we have deployed 
them responsibly. We are audited by the Federal Government. So 
I think we have done a good job. 

You have identified one of the key concerns. Senator, that all 
States have, especially in this challenging fiscal climate. We are 
facing tremendous pressure to balance our budgets to meet the le- 
gitimate needs of the people we serve, and I am sure you have 
heard stories from around the country about dramatic service cur- 
tailments that States are now facing because of this fiscal and eco- 
nomic crisis. So to impose an additional responsibility through 
REAL ID obviously means that something has to give in terms of 
State finances. 

For most of the last century, when drivers’ licenses were first 
issued, it has been exclusively a State responsibility, a State discre- 
tion. States have decided how to do it. But now the Federal Gov- 
ernment has imposed some requirements. And I do not object to 
them, but I think it is fair that it not be an unfunded mandate. 

So I really do appreciate the resources that have been proposed, 
the more cost-effective approach that your bill recommends. We be- 
lieve about half as costly as what it is in the REAL ID law, and 
I think especially in this climate that is a critically important fea- 
ture. 
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Senator Akaka. Thank you very much for your response. 

Secretary Napolitano, the PASS ID Act requires that DHS issue 
regulations to implement it within 9 months after the bill is en- 
acted. Some have expressed concern that DHS could not meet the 
deadline, although substantial portions of the REAL ID regulations 
could be used to craft PASS ID regulations. 

Do you believe that DHS will be able to meet this deadline? 

Secretary Napolitano. Senator, yes. It will be tight, and it will 
be tough, but we believe that we can. As you yourself noted, we are 
not starting from scratch here because really PASS ID is a REAL 
ID fix, so that we have good building blocks from which to work. 
So, yes, we believe 9 months can be met. 

And, indeed, even if there were to be some slippage, we still 
could get regulations out prior to the effective date of what REAL 
ID would have provided because the PASS ID time line would actu- 
ally end with full implementation 1 year before REAL ID would 
have. 

Senator Akaka. Thank you very much for your response. 

Thank you, Mr. Chairman. 

Chairman LlEBERMAN. Thanks, Senator Akaka, very much. 

Senator Voinovich, welcome back. 

Senator Voinovich. I apologize if any of these questions have 
been asked already, but. Governor Douglas, it has been said that 
PASS ID allows States to rubberstamp applicant source documents 
like birth certificates and Social Security numbers. I want to point 
out that PASS ID does in fact require confirmation of Social Secu- 
rity numbers using the Social Security Online Verification data- 
base. 

But can you speak to any concerns you have with the other 
REAL ID verification requirements such as the requirement that 
birth certificates be verified using the Electronic Verification 
Events database? 

Governor Douglas. Well, as you noted. Senator, some of the re- 
quirements in PASS ID are the same as they are in REAL ID in 
terms of verification of those source documents. So that should give 
all of us a sense of belief that those verifications will be as strong 
as they were under the current law. 

The problem is these national databases, such as vital records or 
the passport verification database or the drivers’ license informa- 
tion-sharing one that was referred to earlier, are not available. 
They are not up and running, and so I think to have a requirement 
as we do in the REAL ID law that is not there does not give any- 
one a sense of security. 

So I think PASS ID is equally strong in these areas of document 
verification, and the pilot project that the Secretary mentioned in 
terms of drivers’ license verification will give us a sense of whether 
that can be done on a more universal basis. 

Senator Voinovich. Madam Secretary, can you speak to the sta- 
tus of efforts to develop the systems, the databases that we need 
to verify passports and birth certificates? 

Secretary Napolitano. I can, although those questions are more 
appropriately I think probably for Departments of State and 
Health and Human Services (HHS) which has, of course, the birth 
certificate registry. 
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But it is known as the Electronic Verification of Vital Events 
(EWE). I believe that something like 13 States now are partici- 
pating in EWE, which is the birth certificate database, but the re- 
mainder are not. I do not know the schedule for or the ability of 
the full implementation of birth certificate validation at HHS be- 
yond what EWE provides. 

Senator VOINOVICH. I would hope that maybe somebody in your 
shop would kind of keep track of where they are in regard to that 
because that certainly helps to achieve the goal that we have, and 
that is the best drivers’ license that we can possibly have from a 
security point of view. 

And, Governor, as these databases come onboard, I am sure that 
you and other governors are going to take advantage of them. 

Governor Douglas. I am sure we will. Senator. I was talking 
with the folks in our vital records office yesterday before coming 
here, and it is quite a process to get all of those data entered in 
a form that can be accessed in a consistent way. Some of our vital 
records prior to 1950 are in different media from those between 
1950 and 1980 and then there have been different systems since 
then. So we are working at it. 

I indicated earlier that we are doing everything we can to comply 
with REAL ID, and it is so onerous, frankly, that we are not going 
to meet the benchmarks that have been established. So we will cer- 
tainly take advantage of what is available when it is. 

Senator VOINOVICH. Thank you. 

Chairman LlEBERMAN. Thanks very much. Senator Voinovich — a 
good exchange. 

Senator Burris, welcome. 

OPENING STATEMENT OF SENATOR BURRIS 

Senator Burris. Thank you, Mr. Chairman. 

I am just trying to figure out where to start on this issue for our 
distinguished panel. 

I am holding up here an Illinois drivers’ license and an Illinois 
ID card. Illinois issues an ID card if you go in and request it in 
addition to your drivers’ license, which I use to go through the air- 
port securities. 

I am just wondering if a person does not drive. What we did was 
issue this card for ID purposes, and even PASS ID and even REAL 
ID I understand that we are seeking to do it based on a drivers’ 
license. Is that correct? 

Secretary Napolitano. Senator, under both bills, when they use 
the word, drivers’ licenses, they also include within that any identi- 
fication issued by a motor vehicle division in lieu of a drivers’ li- 
cense for nondrivers. 

Senator Burris. OK, because what I am hearing is if a person 
does not drive or if a person is 14 or 15 years old they will not have 
a drivers’ license, but they should have some ID to get on the vehi- 
cle. So the PASS ID would also encompass some identification from 
the State. 

Rather than a State ID, why cannot we have a national ID where 
this burden would not be placed on the States? The States do not 
have the burden of trying to process this cost. 
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Have you ever been to O’Hare Airport? I just left Midway Air- 
port. 

And I am hearing, Madam Secretary, that you say that if they 
do not have the REAL ID after December, O’Hare Airport will 
probably shut down. If you do what you are talking about doing, 
where there is extra screening, you will probably have to be at the 
airport not 2 hours earlier but 3 or 4 hours earlier. And so, I just 
see the biggest mess coming in a city like Chicago that would just 
hamper even air travel. 

So I am just wondering, is there something that we are talking 
about where the verification can be done where there would be a 
national ID rather than a State ID? 

Secretary Napolitano. Well, Senator, I do not know about the 
possibility of a national ID. There is obviously a lot of pros and 
cons on that approach. 

Senator Burris. I am sure there would be. 

Secretary Napolitano. We are not taking that kind of a bite nor 
are we seeking that right now. What we are seeking is a fix to 
REAL ID so that come December 31, 2009, I, as the Secretary of 
the Department of Homeland Security, do not have to make the 
choice between enforcing the law that Congress has passed and cre- 
ating what could be, at the minimum, a lot of confusion at our Na- 
tion’s airports. 

Senator Burris. Madam Secretary, we are hoping that we can 
have PASS ID. 

And I do not know, Mr. Chairman, whether or not we can get 
PASS ID which is a lot better than REAL ID, but we might even 
want to take it to another step further because I look at what TSA 
is doing now and to put that burden on a TSA worker, what they 
go through now at the airport. It is unconscionable, listening to all 
of the screening in process, which is pretty acceptable to the trav- 
eling public. 

But I still see, for example, I left home the other day and did not 
have my ID with me. Even as a U.S. Senator, there was a process 
that I had to go through to get on an airplane, and everybody knew 
me in Chicago. I am no stranger. 

And I just wonder what would have happened to old John Doe 
out there who showed up to the airport, had to get to work, had 
to get to this meeting, with no ID. I am sure there is a process, 
and they took me through a process. 

I had to verify addresses. I had to show two or three places 
where I lived, and they knew me. So the TSA staff is doing their 
job. Madam Secretary. I want you to know that. And they put me 
through every rigor, and I did not complain either because I do not 
want anybody else getting on that plane that has not been properly 
identified. OK? So that is not the argument here. 

But I am just wondering, what Wrden are we going to put on 
that poor TSA screener, that is looking for a raise by the way, and 
may have to make that judgment, even with the REAL ID or the 
PASS ID? Are we taking those into consideration? 

Secretary Napolitano. Senator, I would say yes, and I would say 
with PASS ID which will indicate that a license or identification 
card is compliant that we start now to make more straightforward 
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and simplify for the public the identification necessary while help- 
ing us meet our security goals. 

I always retreat to the 9/11 Commission Report. I think my job 
as the Secretary of Homeland Security is to take those rec- 
ommendations and to move us toward implementation which will 
give us greater safety and security in our country. 

And, as we move forward, we reach some of these pragmatic, 
practical problems. It is not a surprise that the first stab at identi- 
fication like this REAL ID needs to be fixed and the pragmatic 
problems addressed. But for a worker at an airport, say a TSA 
worker, making more straightforward what kind of ID is accept- 
able, the indicators for that kind of ID and the like should help us 
overall reach our 9/11 Commission goals. 

Senator Burris. Well, Madam Secretary, I know that I just had 
a couple grandchildren born, and they got issued Social Security 
numbers. So Roland II and Ian are in the database here in the 
Federal Government somewhere. I am just wondering, have we 
looked at and should we not look at a national database that would 
give the identification of the Americans and the individuals in this 
country? 

Has anyone done any studies in reference to that or it was just 
actually in the REAL ID legislation to put it on the States? I am 
sorry I was not here at the time, and probably you were not here 
either, I would assume. 

Secretary Napolitano. I was a governor. 

Senator Burris. And I think I was enjoying life. [Laughter.] 

But I just wondered, do you have any knowledge as to how that 
or you do not know? 

Secretary Napolitano. I do not. 

Senator Burris. Governor, did your State look at that at all in 
terms of the past actions? 

Governor Douglas. We have not considered a national approach 
other than the approach that we are discussing this morning which 
is PASS ID. 

I think the urgency of getting something done before the end of 
this calendar year is such that we ought to all work together, find 
some consensus as this process has done without getting into an 
area that might be more difficult. 

Senator Burris. I am thinking about the long run. Governor, 
down the line because I just see this PASS ID even itself is not 
going to be as secure as we think it is because the documentation 
in the databases are the same databases you use for REAL ID. The 
question is just how secure is that going to be? 

I think we ought to look at, if we get this in place, certainly so 
we can get a little bit more security with our travel or the identi- 
fication, but I hope and pray that we will look at even taking it 
to a higher level without the invasion of privacy. We still have the 
privacy issue here that we must deal with. 

And the transfer — I mean I do not see how you are going to deal 
with Illinois, Ohio, and Michigan. When I go to Ohio and I am 
traveling out of Ohio, it is a different issue in how they issue there. 

I am looking at the start on this. Is this what they are planning, 
this process here where they have the REAL ID process? Is this 
what would be the new PASS ID document? 
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Secretary Napolitano. It would be something like that to indi- 
cate that something is compliant — very simple, very easy for some- 
body to observe and note, like a TSA worker. 

Senator Burris. Which would mean that, too, could be counter- 
feited as well as any of the other documents. So I do not know 
whether that is going to be really the solution with this type of a 
special identification because after you get the documentation the 
person can produce false documents or be in the database with 
false documents and still get a star on his drivers’ license. 

Secretary Napolitano. Senator, I think we would be more than 
happy to brief you and your staff on other protections that are built 
in the documents to inhibit forgery, false ID, and the other things 
that are built now into drivers’ licenses that make them more dif- 
ficult to manufacture in a fraudulent way. 

Senator Burris. I appreciate that. 

Secretary Napolitano. It is never 100 percent, but it is much 
more difficult than years past. 

Senator Burris. Thanks so much. 

I am sorry about my time, Mr. Chairman. Thank you. 

Chairman LlEBERMAN. No. Thank you. Senator Burris. We are 
glad you are not enjoying life as much as you used to because you 
contribute to the work of our Committee. I thank you. 

I think we better move on to the second panel. I thank you. 
Madam Secretary and Governor Douglas. It has been a very helpful 
exchange. 

We understand the urgency of this matter, and the next markup 
of this Committee is actually 2 weeks from today. So I want to 
challenge each of us to work together urgently because my goal, 
and I know Senator Collins’ would be, is to get this PASS ID before 
that markup on July 29. 

Thank you both very much. 

We will now call the second panel: Stewart Baker, Sheriff Leroy 
Baca, David Quam, and Ari Schwartz. 

Thank you, gentlemen, for your patience. We appreciate very 
much that you are here. Some come a long way, as Sheriff Baca 
has. We welcome you back again. It is great to see you. 

We will begin with Stewart Baker, former Assistant Secretary for 
Policy at the Department of Homeland Security. Secretary Baker 
has occupied a role, which is new because this is a new depart- 
ment. But in the Armed Services Committee, we are quite regu- 
larly hearing from former executives of the Department of Defense 
who really have the experience and continue the interest and, 
based on that experience, really have a lot to offer. 

So I think you are doing this as well or better than any of this 
first generation of executives, now former executives, of the Depart- 
ment of Homeland Security. Whether one agrees with you or dis- 
agrees with you on a particular matter, I really thank you for your 
continuing interest in our homeland security, and I welcome your 
testimony. 
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STATEMENT OF HON. STEWART A. BAKER, i FORMER 
ASSISTANT SECRETARY OF HOMELAND SECURITY 

Mr. Baker. Thank you, Senator. I feel very strongly about mak- 
ing DHS a success and anything I can do in my current capacity 
to contribute to that I am delighted to do. 

Mr. Chairman, Ranking Member Collins, and Members of the 
Committee, it is a pleasure to be here. 

I have raised four concerns in my prepared testimony. I am going 
to talk principally about one of them today, and that is the source 
document problem. 

I think it is easiest to understand that if you have heard the 
story, as I heard from his relatives, of Kevin Wehner. Kevin 
Wehner was a carpenter. He had three kids. He took a vacation in 
the Virgin Islands around 2002 or so, and in the course of that his 
wallet was stolen. About 2 years later, he started hearing that he 
was wanted for speeding tickets, for other abuses of a license in 
Florida. 

It turned out that someone had walked into the Florida Depart- 
ment of Motor Vehicles, presented his Social Security card and a 
birth certificate, almost certainly just made up, from the Virgin Is- 
lands in his name. On the strength of that, Florida gave this im- 
poster a drivers’ license in Kevin Wehner’s name. 

Kevin Wehner tried to cure that problem long distance from New 
York, was unable to do that, finally moved to Florida, and in the 
course of living in Florida asked for a drivers’ license. And the 
State said, “no, you cannot have a drivers’ license. You already 
have one.” He said, “no, that is not me.” 

They asked for more paperwork. He provided the paperwork. 

A year later, Kevin Wehner was still wanted by the police for nu- 
merous speeding tickets and unregistered vehicle violations. He 
was at risk every time he drove his car of being pulled over and 
sent to jail because of the bad birth certificate that had been ac- 
cepted by the Florida Department of Motor Vehicles. 

That is quite aggravating and dangerous, but it was only the be- 
ginning of the nightmare for him. Because on September 13, 2007, 
the guy that the police knew as Kevin Wehner was stopped, pulled 
over. He got out and pulled out a semiautomatic weapon that he 
had bought in Kevin Wehner’s name, and he shot down four police 
officers, killed one of them, and fled. 

The police immediately put out an all points bulletin for him, for 
Kevin Wehner. They went to the Florida Department of Motor Ve- 
hicles and said, do you have a photograph for this guy? 

And they said, yes, actually, we just got a photograph from a guy 
who said he was Kevin Wehner. 

They took the real Kevin Wehner’s photo, spread it all over the 
States, put it in an all points bulletin to the police. So, now, if he 
is stopped while driving, he does not risk just going to jail. 

You can imagine what the reaction of the police force of Jackson- 
ville would be if they pulled over somebody that they believe was 
a wanted killer of police officers, he is driving Kevin Wehner’s car. 


^The prepared statement of Mr. Baker with attachments appears in the Appendix on page 
98. 
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he looks like Kevin Wehner, they ask him, are you Kevin Wehner, 
and he says, yes, I have my license right here. 

I do not think that his chances of surviving that encounter are 
very high. In fact, when they finally did straighten this out, the po- 
lice went looking for the guy who they really wanted, and he was 
killed in a gun battle with the police that evening. 

The risk to Kevin Wehner from that bad birth certificate is as- 
tonishing. What is difficult to credit is that Florida is still accepting 
birth certificates without doing anything to check the validity of 
those birth certificates. That is something that REAL ID would 
have fixed. It is something that PASS ID allows to continue perma- 
nently. 

PASS ID deserves some credit. PASS ID has worked hard to 
make sure that the documents are not easily forged, and I think 
we should acknowledge the value of that. 

But, given a choice between having a license that is hard to forge 
and birth certificates and other source documents that are hard to 
forge, we really should be choosing to make the birth certificates 
more checkable than the drivers’ licenses because drivers’ licenses, 
if you are stopped by the police, they are going to check a database 
to see if that drivers’ license was really issued to you in that name 
with that identity. And so, a fake drivers’ license will not get you 
past a traffic stop, whereas if you bring in a birth certificate there 
is simply no check at all. 

What we should be working toward is having exactly the same 
capability with respect to birth certificates that we have with re- 
spect to drivers’ licenses today. It ought to be possible to say to the 
issuing authority, did you issue this birth certificate? That is one 
of the requirements of REAL ID that is lost here that ought to be 
fixed. 

Just very briefly, the other three items that I talked about in my 
testimony: 

The 9 months to get a regulation out, I do not believe that is pos- 
sible. It would take 10 months even if the Department of Homeland 
Security could do its job instantaneously, which it cannot. I appre- 
ciate the confidence that the Secretary has, but I do not believe 
that she can do it. And, at a minimum, this Committee should try 
to make sure that there is a form of insurance that if that deadline 
is missed the provisions of REAL ID that are really equivalent to 
PASS ID remain in effect. There ought to be a way to fix that prob- 
lem. 

The other two issues, very quickly: I agree entirely with Senator 
Collins. We are creating a litigation magnet by creating a statutory 
right to fly without ID. There is no need to do that, given the cur- 
rent policy. 

And making the expenditure of State Homeland Security Grant 
Program funds for drivers’ licenses something that is a priority is 
something that is particularly valuable. State Homeland Security 
funds come from all taxpayers. They should be used for things that 
benefit all taxpayers and make all taxpayers more secure. Drivers’ 
license security does that. That should be the highest priority for 
the use of State Homeland Security grants, and I urge that you 
enact a priority for that use of the funds. 

Thank you. 
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Chairman LiEBERMAN. Thanks, Mr. Baker. That was a compel- 
ling story about the birth certificate. 

Am I correct, just briefiy, that what you are saying is that we 
ought to be investing money, perhaps Federal money, in setting up 
this national database system? In other words, the so-called EWE 
system is just beginning to come together, and the States are obvi- 
ously not willing to contribute. 

Mr. Baker. I agree that we should spend our money on that. I 
do not think it is a central database. Each State is going to put to- 
gether its own database on its own residents. 

Chairman LiEBERMAN. Yes. 

Mr. Baker. But it ought to be possible for a State to inquire 
whether that birth certificate was really issued. That is all that is 
really necessary, not a centralized database. The cost of that, just 
setting up the connectivity is a few million dollars, and then it is 
probably a couple of million dollars per State to clean up the data- 
bases, roughly. So our guess is that this could be done for a total 
of $75 million spread over 2 or 3 years. 

Chairman LiEBERMAN. That is very practical and helpful. Thank 
you. As you know, I am concerned about that omission in the PASS 
ID legislation. 

Sheriff Baca, thanks for being here. Leroy Baca is the Sheriff of 
Los Angeles County, testifying today on behalf of the National 
Sheriffs Association which has endorsed PASS ID, also a member 
of the Major Cities Chiefs Association. Sheriff Baca leads the larg- 
est sheriffs department in the Nation which has over 18,000 offi- 
cers and staff. 

It is an honor for you to be here. I thank you for going to the 
trouble of coming across the country, and we welcome your testi- 
mony now. 

STATEMENT OF HON. LEROY D. BACA,i SHERIFF, LOS 
ANGELES COUNTY, CALIFORNIA 

Mr. Baca. Thank you. Good morning. Chairman Lieberman, 
Ranking Member Collins, Senator Akaka, Senator Voinovich, and 
Senator Burris. I am pleased to have this opportunity to appear to 
express the associations that were identified by Lieberman that I 
represent in support of S. 1261. 

As the witnesses before me have addressed the problems and 
challenges associated with the implementation of REAL ID, my tes- 
timony will focus on the critical need for a national standard for 
identification security from a local law enforcement perspective, so 
that we can effectively integrate what we are doing here to ensure 
that the homeland security is, in fact, secure. 

Hopefully, my testimony will strengthen the core message of Sec- 
retary Napolitano and Governor Douglas. Together, we recognize 
that the proposal to issue a national standard for identification se- 
curity has been a contentious one. However, we believe that PASS 
ID adequately addresses the cost, policy, and privacy concerns so 
as to protect the citizens that we serve. Nothing will ever be per- 
fect, however. 


^The prepared statement of Mr. Baca appears in the Appendix on page 113. 
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From a law enforcement perspective, it gives us that much more 
confidence that the identification we are looking at is authentic. 
That really is the core reality of the 9/11 Commission request and 
recommendation, that if someone is saying this is who I am and 
they provide an identification card or drivers’ license, that in fact 
that is who they are. That is the ultimate goal. 

It provides one more tool to ensure public safety. It is designed 
to make it much more difficult for terrorists, criminals, and illegal 
aliens to tamper with official identification. 

And so, I would like to just close with two or three points here, 
and that is, as you have stated well, the 9/11 Commission was con- 
cerned that varying State standards created security gaps that 
were exploited by the September 11, 2001, terrorists in obtaining 
State identification documents. As such, the 9/11 Commission rec- 
ommended a national standard, not national ID cards, and PASS 
ID provides a cost-effective, common-sense solution that balances 
critical security requirements with input and practical needs of in- 
dividual States. 

My second point is that PASS ID provides flexibility to the States 
for implementing the security requirements. It also provides flexi- 
bility for validating source identification documents and eliminates 
fees associated with the use of Federal databases. 

The next point is that PASS ID requires the States to develop 
procedures to prevent the unauthorized access or sharing person- 
ally identifiable information. It mandates public notice of privacy 
policies and the establishment of a redress process for individuals 
who believe their personal information should be amended. It re- 
stricts the use of personal information contained in the drivers’ li- 
cense or an ID bar code to purposes in support of Federal, State, 
or local laws and prohibits States from including Social Security 
numbers in the bar code. 

Finally, PASS ID removes the blanket requirement to electroni- 
cally verify applicant documents and protects against the creation 
of a national identity database containing all drivers’ license and 
ID information. I think that really is a key point. 

Finally, only citizens and non-U. S. citizens who are lawfully 
present in the United States are eligible to receive a PASS ID. 

And so, what we are talking about here is simply, in conclusion, 
that millions of contacts a day are made with people in the United 
States who are here legitimately, lawfully in every way possible are 
here to do the right thing as our citizens. An ID system such as 
a drivers’ license or an identification card will come into the hands 
millions of times a day for a variety of reasons. The authenticity 
of these documents is what PASS ID will ensure. 

Thank you very much. 

Chairman LlEBERMAN. Thank you. Sheriff, very much — very 
helpful testimony. 

David Quam is next. Director of Federal Relations at the Na- 
tional Governors Association. We thank you for working closely 
with our staff and with the staff of the Department of Homeland 
Security to put together the PASS ID, and we welcome your testi- 
mony now. 
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STATEMENT OF DAVID QUAM,i DIRECTOR OF FEDERAL 
RELATIONS, NATIONAL GOVERNORS ASSOCIATION 

Mr. Quam. Thank you, Chairman Lieberman, Senator Collins, 
Senator Akaka, and Senator Voinovich. Happy birthday to you, sir. 

Since my boss. Governor Douglas, or soon to be boss as Chair of 
NGA, has already spoken, and my former boss. Secretary 
Napolitano, also spoke so eloquently on this issue, I will be brief. 
I will reiterate some of the instructions that were given to NGA by 
governors. 

Governor Douglas talked about governors coming together and 
talking through this issue. It is remarkable when governors come 
together without staff, person to person, because they are able to 
talk just as governors. They discuss how to make a State run and 
their unique position in having to actually make everything work. 

REAL ID was a source of great frustration for governors and re- 
mains one. We now have 13 States who have said they are not 
going to participate. Governors are very concerned about making 
investments into their drivers’ licenses to increase security and in- 
tegrity, while also making investments that make sense. What 
were the rules going to be? Can we create certainty? And, what 
does the future look like? 

REAL ID, unfortunately, with some of the baggage it created, 
has never created certainty. PASS ID is designed to try to create 
certainty and allow States to move forward. 

When the governors got together, they said, let’s try to find a fix 
and let’s be guided by four things: 

First and foremost, fulfill the 9/11 Commission recommendation. 
That is the starting point and is the commonality for everybody in- 
volved in this issue. 

Second, facilitate and encourage participation by all jurisdictions. 
Allow the 13 States who have said no a way to come back in and 
participate because security standards only work if people are will- 
ing and able to use them. When you have one-fourth of the States 
not participating, it is hard to put verification systems together 
when, for instance, the entire Northwest is not participating. How 
are you going to verify that person’s information if they are from 
Seattle and you are sitting in Atlanta trying to assess whether that 
person should get a drivers’ license? 

Third, enhance the security integrity of all licenses and ID cards 
while retaining State flexibility to innovate. I think you said REAL 
ID was too prescriptive. That was a big fear. States actually want 
to do more. They are happy to have the Federal Government set 
a floor of standards because they want to innovate beyond it. I 
think the experience States have had with the Enhanced Driver’s 
License show the commitment of States and governors to actually 
take security standards and move beyond what is required because 
they share your interest in security and integrity. 

The last guideline address critical privacy concerns and reduce 
unnecessary costs. Let me focus on privacy just for a minute be- 
cause I think it is important to view some of the systems that 
PASS ID does not include in this context. Privacy was a key driver 


^The prepared statement of Mr. Quam with attachments appears in the Appendix on page 
118. 
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in a lot of the States that ultimately have said no. Privacy was a 
concern because there were databases being set up that actually 
threatened personal identity and encouraged identity theft by pro- 
viding databases that could ultimately be hacked. That was a con- 
cern, a political concern, in several States. 

The privacy concern was followed by one of implementation, 
questions about whether this could actually be done. And then of 
course there was cost, that this was an unfunded mandate. 

This was Washington, once again setting the rules and, as Sen- 
ator Lamar Alexander loves to say, sending the bill to the States. 

These issues combined to have 13 States and then 11 others pass 
resolutions saying: You know what? This was a bad idea. We are 
not going to comply. 

What PASS ID does and is designed to do is to stop kicking the 
can down the road. Let’s solve the problem. Let’s create certainty. 
Let’s do what we can now. 

Verification is increased under PASS ID because all States will 
conduct verification through SAVE and SSOLV. It should be noted 
that right now I believe 49 States use SSOLV and 30 use SAVE. 
PASS ID would require everybody to come in. That is a level of 
verification that did not exist pre-September 11, 2001, does not 
exist now, but would exist after PASS ID. 

The three systems that the Governor talked about that are ques- 
tionable or that would not be required right away — the drivers’ 
database, passports and even vital records — are very difficult to im- 
plement, but PASS ID does not say get rid of them. It says pilot 
them. Let’s spend the time and money and make the investment 
to see if we can make these things work. 

And, if we can make them, if we can get them funded and they 
are cost-effective, governors and DMVs will use them. But, as one 
governor said to me, he said, “David, can you tell me today how 
any of these systems are governed, who owns them, how they are 
paid for, or how you are protecting my citizens’ identity?” 

The answer for all of his questions was “no.” 

He said: “In that case, how can I sign up for this law and put 
my folks on the line? Until those questions are answered, I cannot 
move forward.” 

I think that is a good standard, and PASS ID represents a solu- 
tion to this problem. 

I will add that many of the advocates who have participated in 
this process, to a degree, are not completely satisfied. In Wash- 
ington, that probably means we found the right solution. 

Thank you, sir. 

Chairman LlEBERMAN. Thank you. 

The final witness is Ari Schwartz. We welcome you back to the 
Committee where you have testified to our benefit before. 

Mr. Schwartz is the Vice President and Chief Operating Officer 
of the Center for Democracy and Technology. 
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STATEMENT OF ARI SCHWARTZ, i VICE PRESIDENT AND CHIEF 

OPERATING OFFICER, CENTER FOR DEMOCRACY AND TECH- 
NOLOGY 

Mr. Schwartz. Thank you very much, Mr. Chairman, Senator 
Collins, and Members of the Committee. Thank you for having this 
hearing and for inviting me to testify today. 

I would particularly like to thank Senators Akaka and Voinovich 
for their leadership on PASS ID and moving this forward, and also 
our colleagues at the National Governors Association for trying to 
bring this back to a nonpartisan place where we can have this dis- 
cussion. 

I was actually on the Intelligence Reform Committee that worked 
on a negotiated rulemaking, and I think that Senator Collins has 
very eloquently laid out what that Committee’s charge was in try- 
ing to come up with rules that protected privacy while still meeting 
the 9/11 Commission’s goals of flexibility, of standards for issuance 
and for getting the information on the card. 

That is really what the folks on the 9/11 Commission wanted, to 
make sure that we had this ability to improve the drivers’ licensing 
system, to be able to use it, to be able to rely on it for purposes 
of national security but then also that we had privacy and we had 
the flexibility built in as we went forward. If you go back and read 
the 9/11 Commission Report, it is very clear that civil liberties 
issues in particular are of great concern to the Commission. 

Unfortunately, REAL ID really pushed this discussion to the 
edges. We really had a discussion at the extremes where now we 
have one side that is committed to this kind of rigid standardized 
discussion that represents REAL ID, where privacy has been re- 
moved from the discussion. Remember, the Intelligence Reform Act 
specifically said that we needed to have privacy standards in place. 
Those were taken out in REAL ID, and DHS noted that in their 
notice of proposed rulemaking originally under REAL ID, that they 
could not put in the same kind of privacy standards that they 
would have been able to under the Intelligence Reform Bill, and 
that seemed to be Congress’s intent. So we have taken a step back 
from that. 

On the other side, you have groups and other public policy offi- 
cials that would prefer to do nothing, that feel the problems could 
come from tinkering with the current situation might be worse 
than where we end up down the road. 

We do not think that either of those possibilities are the right so- 
lution. The truth is probably somewhere in the middle and that we 
need to be moving down in the direction to get at that answer. We 
think PASS ID does that. 

PASS ID addresses the issues with REAL ID by retaining the 
current federated system but protecting information in the ma- 
chine-readable zone while keeping REAL ID’s minimum standards 
for obtaining a license and the standardization of information on 
the card. 

Importantly, PASS ID would require States and law to create 
privacy and security safeguards including internal fraud and phys- 
ical security. We have seen time and time again that the greatest 


^The prepared statement of Mr. Schwartz appears in the Appendix on page 127. 
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weakness of the drivers’ license system actually is of internal fraud 
and of physical security within the DMVs. From California to 
Washington, DC, even in the past 2 years, we have seen cases of 
workers at DMVs selling real licenses for $1,000 to $2,000 to indi- 
viduals that should not be able to get them under the current law. 

We have also seen several cases where employees have sold the 
entire DMV database of information to identity thieves who are 
using it for identity theft. 

Before we can rely more heavily on the drivers’ license for au- 
thorized purposes, we should ensure that these problems are being 
addressed by the States has PASS ID would require in law. 

We ask the Committee to ensure that these important privacy 
and security protections are not weakened as we move forward. 

We also urge you to consider other changes in this direction: In 
particular. Congress repeal the mandate for standardized machine- 
readable zone, limit the data elements that may be contained in 
the machine-readable zone and limit access to the machine-read- 
able zone to only what is necessary for legitimate law enforcement 
and administrative purposes. 

Congress should reject the use of the vicinity read technologies 
that can be easily cloned and are not secure for human identifica- 
tion purposes. 

And, finally. Congress should require States to minimize storage 
of copies of source documents to prevent fraud and theft of the 
source documents. 

We look forward to working with the Committee as you move for- 
ward, and I look forward to your questions. 

Chairman LlEBERMAN. Thanks very much, Mr. Schwartz. As al- 
ways, you have been helpful. 

I am going to ask just one question, and then unfortunately I 
have to leave to go to a meeting at noon. But I thank the witnesses 
very much. Senator Collins and Senator Akaka will go on in my ab- 
sence. 

Mr. Schwartz, I want to ask you because, as you heard in the 
first panel, I am concerned — and you referred to it — about the im- 
portance of the States validating source documents, the kind of doc- 
uments that people use when they come in and apply for a drivers’ 
license. 

Secretary Napolitano and Governor Douglas basically gave two 
reasons why they were either opposed or skeptical. One was that 
with the privacy concerns, and the other was the cost for the 
States, particularly to input birth certificate information. Mr. 
Baker obviously spoke at some length with that anecdote about 
that. 

I wanted to ask you whether your privacy concerns about that 
kind of system, about the mandating that States cooperate and pro- 
vide data to one another about the source information, particularly 
birth certificates, whether you have great privacy concerns, wheth- 
er they can be taken care of, how you feel about it. 

Mr. Schwartz. Yes. Thank you, Mr. Chairman. 

We support the idea of the pilot and moving forward with the 
pilot exactly as Mr. Quam put forward. 

The main reason of the concerns is that the quality of the infor- 
mation in these databases is just of a very poor quality. I know this 
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from my personal life. Actually, my wife’s date of birth was wrong 
on my son’s birth certificate, and when I went in to go to change 
it they appended it at the bottom of the form. They do not change 
the field itself. Every State, every locality has had differing stand- 
ards for how they go about making these changes and what they 
do with this information for hundreds of years. 

So, if you say we are all going to connect this information to- 
gether, which I agree just connecting the information together is 
fine, I think that the cost of correcting the information, of getting 
it linked so that they are standardized — you are talking about 
standardized forms — it’s incredibly expensive. And then the ability 
to put security protections on top of that is questionable as well. 

So we know there are a lot of problems with the quality of the 
data. Then you have people going in, correcting it, saying, as you 
would, as identity thieves often do, pretending to be these people. 

We know that there have been problems in the past when people 
have gone through and said, oh, I need to correct my record. And 
they go in, and they pretend to be someone else when correcting 
it. How do we deal with that kind of situation where we can correct 
this? 

Now we may be able to do it. I do not think we are going to be 
able to do it in 6 months. 

Chairman LlEBERMAN. Mr. Baker, would you give me a quick re- 
sponse to Mr. Schwartz’s comments just now? 

Mr. Baker. Sure. He is correct that there will he problems at the 
margin with respect to errors in the database. But for 90 or 95 per- 
cent of the records you will get a quick check, and this means that 
you will eliminate entirely a massive amount of fraud today which 
consists of making up birth certificates that did not exist as in the 
Kevin Wehner case. 

So we ought to solve the big problem first. The secondary prob- 
lems can be addressed by simply picking up the phone when you 
have a problem and saying to the State, can you tell us whether 
this birth certificate is a good birth certificate? 

This is what the Social Security Administration does today, and 
that allows you to take care of notations on the birth certificate 
and other things. 

It does mean that you then have to find a way to make those ad- 
justments to the database, but we would be so lucky to have that 
problem. Today, we have Kevin Wehner’s problem. 

Chairman LlEBERMAN. Thank you. Senator Collins. 

Senator Collins. Thank you, Mr. Chairman. 

Sheriff, we have talked a lot today about the issue of terrorists 
using drivers’ licenses, but more secure drivers’ licenses also have 
applications for prohibiting or making it more difficult for counter- 
feiting to take place, and you address some of that in your written 
statement. Could you talk more about the benefits of more secure, 
authentic drivers’ licenses to you as someone who is involved in law 
enforcement? 

Mr. Baca. Yes. Thank you. Senator. 

The key point of authenticity of identification tools, in this case, 
drivers’ licenses or ID cards: Identity theft is a tremendously large 
problem, and right now a lot of people are vulnerable within data- 
bases out there in the internet world that are tapped into by people 
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who have the skills to access that information. The key then is that 
there has to be some point where there is a reliable identification 
source which would be the drivers’ license under a PASS ID system 
or the ID card. 

The volume of what people are fearful of in America is that their 
ID will be stolen from them as was given in the example by Mr. 
Baker. And so, we in local law enforcement, along with our Federal 
partners, are very wrapped up in a huge amount of identity theft 
with not enough resources to chase down all the offenders involved. 
This is an international problem as well as a national problem. 

So part of the reason, I think, in the discussions with the major 
city chiefs along with the National Sheriffs’ Association members 
on this issue is to see the value of this not purely from a prevention 
tool for terrorism but for a purpose of preventing all forms of crime 
where people’s IDs are so easily acquired, even if they lose a driv- 
ers’ license. 

And everyone has their anecdote here. My drivers’ license and 
one of my credit cards were taken, and within an hour they were 
trying to purchase some products from a department store. Fortu- 
nately, the clerk was alert and said, show me your drivers’ license. 
Well, the person had my drivers’ license, but they were not going 
to produce it because they did not quite look like me. 

But you get the drift that this is a far more reaching solution to 
an ongoing problem before September 11, 2001, and September 11, 
2001, accentuates the need now. 

Senator Collins. Thank you. I think that is a very important 
point, and it is the point that Mr. Baker made as well that we 
should not overlook in this debate. 

Mr. Schwartz, I appreciate the very constructive approach that 
you have taken to these negotiations. There is a provision of the 
bill that I would like to get your thoughts on, and it is the provi- 
sion that criminalizes the act of scanning information contained on 
the drivers’ license machine-readable zone and using that informa- 
tion to track the use of the card, to store information that is col- 
lected or resell it to a third party. 

I certainly understand what this provision is trying to get at, and 
I support the desire to curb the unauthorized use of this private 
information. 

Some business organizations, however, have expressed the con- 
cern that this language is over-board, and they point to an earlier 
version of the bill that would have allowed the use of the language 
to prevent illegal activity or fraud. They have given us an example 
of a business that uses that information to identify someone who 
is repeatedly returning merchandise at different locations in order 
to commit a fraud. 

What is the concern about adding an exception if the information 
is used to prevent fraud, misrepresentation or other illegal activity? 
As I indicated, that was in one of the earlier versions. 

Mr. Schwartz. Yes. Well, first of all, thank you. Senator Collins. 
This is an extremely important provision for us and I think for pri- 
vacy advocates and for a lot of citizens that feel that when they 
give their license to someone they want to understand what is hap- 
pening to it behind the scenes. 
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The issue there with the fraud exception really is to look at how 
broad that fraud exception is. We have seen a lot of fraud excep- 
tions that are created for one purpose and used for many purposes 
down the road, and I think there is a lot of concern over that issue. 

In fact, it is my understanding that actually the Department of 
Justice had concerns over this fraud provision as well as groups 
like ours did, which tells you about the concern about how this may 
be used down the road. In fact, we have seen cases where bars say 
that they are swiping information to get the age of individuals but 
then use that same information to give to tobacco companies, to 
market information to tobacco companies about students at local 
colleges who come into the bar. 

Senator Collins. That is indeed troubling. 

Mr. Schwartz. Yes. 

Senator Collins. Very troubling. 

Mr. Schwartz. That happened in Oklahoma last year. 

So we know for a fact that it is taken, and people think that it 
is being used for one purpose, but then it gets used for many other 
purposes. How do we stop that and where do we put that in? 

We are OK with the swipe and saying: This is the same person. 
This is the same card that we saw over here when we looked at 
this person. 

So if all they do is type in the information in the case of your 
example, type in basic information about the individual. Then 
when they come back and swipe the card somewhere else, it can 
populate itself at that point. So we are not talking about a major 
ban — swiping of the card is OK to check the authenticity of the 
card and that the information on the card is real. The question is 
really about using it to populate information that then can be used 
for many multiple other purposes. 

Senator Collins. Thank you. 

Actually, Senator Akaka, I am not sure which one of us is Chair- 
man right now. So perhaps I should be saying, thank you, Mr. 
Chairman, instead of recognizing you for your questions. 

Senator Akaka [presiding]. Thank you very much. Madam Chair- 
man. 

Mr. Baker, as you may have heard in the first panel, I asked 
Governor Douglas about the States’ use of grant funds. You ex- 
pressed concern in your testimony about the prioritization of identi- 
fication security and recommended that PASS ID include language 
ensuring that grants to improve drivers’ licenses are a higher pri- 
ority than other State projects. 

Would you recommend that the Federal Government require 
States to comply with secure identification standards before they 
can use funds for priorities such as first responders or disaster pre- 
paredness? 

Mr. Baker. Let me start by saying I think we all recognize that 
one of the biggest concerns on the part of the States has been a 
sense that they are being asked to spend money that they do not 
have. There has never been a good cost estimate, but it is clearly 
not free to come into compliance with the improved security for 
drivers’ licenses. 

At the same time, of course, the Federal Government is sending 
hundreds of millions, nearly a billion dollars, to States specifically 
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to improve homeland security. It is both a Federal responsibility 
since we want them to improve their drivers’ license security, and 
a State responsibility to use taxpayer money that comes from tax- 
payers all over the country, to use that many first for things that 
will benefit people all over the country. 

Since a drivers’ license and, as we saw, a birth certificate issued 
in the Virgin Islands is good in Florida, we need to have a national 
system and we need to encourage people to spend their Homeland 
Security funds first on things that will help improve the security 
of all Americans. 

I do not think it is necessary to say you cannot spend money on 
anything until you have fixed everything about your drivers’ license 
security, but I do think that it should be one of the top three prior- 
ities and States should have to spend some of their money improv- 
ing drivers’ license security until they are at the point where they 
say, we think we are there, and the Homeland Security Depart- 
ment agrees. 

Senator Akaka. Thank you. 

Mr. Quam, I have a question relating to some of the electronic 
databases that are required by REAL ID and are slowly being im- 
plemented by a handful of States. In particular, I am interested in 
the Electronic Verification of Vital Events records. 

As I understand it, some States are using the system to help 
electronically verify birth certificate information. However, only a 
few States currently have scanned birth records included in the 
system. Can you speak to the current status of this, of States’ use 
of EWE and whether it is feasible for DMVs to use EWE on a 
widespread basis to verify birth certificates in the near term? 

Mr. Quam. Thank you for the question. Senator, and also thank 
you for your leadership on this issue and for the help of your staff 
who has been just tremendous in trying to pull together so many 
different interest groups to find a solution. 

With regard to EWE, I know that the National Association for 
Public Health Statistics and Information Systems (NAPHSIS), 
which is the organization that runs that particular system, has, I 
believe, submitted a statement. ^ About 15 States currently partici- 
pate in EWE. Only three DMVs currently use that system. We 
have 56 jurisdictions — only 3 currently use it. 

NAPHSIS, the organization, according to their testimony, be- 
lieves that about 85 percent of birth records dating back to 1935 
are in electronic form. I would like to see verification of that num- 
ber. Certainly, I have no reason not to believe that. 

I do know that several States have had great difficulty in actu- 
ally transferring especially old records into electronic form, and 
making them consistent, accurate, and usable. That is not an easy 
task to do at the end of the day. 

Eor example, there is one State that just recently moved its li- 
censes to a legal presence standard, which means people had to 
prove legal presence in the United States. That State had to set up 
a war room just for issues related to birth certificates because for 
all those people coming in, those who are in the United States le- 
gally who are, say, foreign-born or foreign residents had no prob- 


^The statement referenced by Mr. Quam appears in the Appendix on page 164. 
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lem showing that they were legally present. The person who had 
the problem showing that they are a citizen of the United States 
happened to be the grandmother who is over 60 years old whose 
birth record was in the family Bible that was in the house that 
burned down. That person had a problem proving that they were 
in the United States lawfully. And so, the State spent more of its 
time with those citizens than it ever did with other people who 
could easily show their legal status. 

Transferring birth certificates into electronic form and creating 
electronic databases is not an easy task. I think it has to be done 
slowly. It has to be done in a meaningful way. 

Again, the questions I heard from governors were not about 
should we do it. A lot of them said: If it is there, that is great. 
Maybe we will use it. But we want to know about the governance. 
We want to know about the privacy protections and the accuracy. 

Even for EWE, they estimate that they will have about 90 or 
95 percent accuracy. The way that translates into a line at the 
DMV is that one of every 10 people is going to get a false reading. 
That means delays. That means additional time, perhaps another 
trip to the DMV. You can be one of those citizens who has been 
in the same house, the same county, the same city all your life, but 
you are going to be rejected if this system does not work well and 
is not 100 percent reliable. 

The pilot project is aspirational. Let’s see if we can get it up and 
running. Let’s see if we can solve those questions. It is somewhat 
of an “if you build it, we will come” situation. 

I would add to that, if you build it right, I think the States will 
come along. But we need to do that on a cooperative basis. We do 
not need to rush it just to meet REAL ID standards. 

Senator Akaka. Thank you, Mr. Quam. 

Mr. Baker, you testified that all birth certificates which generally 
are in paper form in county vital records offices throughout the 
country probably could be digitized and made searchable through 
EWE for $100 million or just $2 million per State, not counting 
Washington, DC, and the territories, in addition to a total of $4 
million to get EWE activated in all States. What is the basis of 
that estimate? 

Mr. Baker. That estimate is derived in part from the estimates 
that we received when I was in government based on the experi- 
ence of the States that actually had to digitize their records and, 
as well, from NAPHSIS which administers the program or admin- 
isters the database. 

Senator Akaka. Thank you for that. 

Senator Collins, do you have further questions? 

Senator Collins. Thank you, I do. 

Mr. Quam, there are some States that have vigorously protested 
REAL ID and have passed legislation forbidding compliance with 
it. There are other States that have invested a great deal of money 
and effort and have taken steps towards compliance. Vermont is 
one of those States. 

If PASS ID was to pass and we have new implementing regula- 
tions, is there concern that the investments made by States who 
are seeking to comply with the law would be for naught or do you 
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consider the PASS ID bill sufficiently similar to current law that 
those investments would still be put to good use? 

Mr. Quam. It is an excellent question, Senator, and I think it is 
the latter. PASS ID builds on the strengths of REAL ID and be- 
cause so many of the 18 benchmarks that States have to meet at 
the end of this year are still part of PASS ID you are going to see 
security increased across the board. That also happens to be where 
most of the State investments have been made. Therefore, those in- 
vestments are not lost. They are actually used. So you are going 
to keep the value for those who have invested. 

It is interesting, that even in some of those States who have been 
such vocal opponents, some of those very same governors have gone 
on their own and said: You know what? I want to invest in a secure 
license. I hate REAL ID, but I am going to invest. 

Their licenses and their systems are actually fairly close to meet- 
ing those 18 benchmarks. PASS ID gives them an opportunity — 
legislators, governors, all those who protested a law that they do 
not like — to reevaluate and to see if this makes more sense and 
their investments can actually have value down the road. 

Senator Collins. That is an excellent point. I had noticed that 
as well when I have looked at individual States, the fact that some 
of the States that have protested the loudest are in fact close to 
compliance, or at least have reached material compliance with the 
law, but understandably they did not like Washington telling them 
how without consultation. They also, in some cases, were resentful 
of the financial burden. 

Does every State currently have a requirement for legal pres- 
ence? 

Mr. Quam. I will look to some of the other panelists. I believe we 
are almost there. When REAL ID first went into place, I think 
about 10 States did not have it. 

Senator Collins. Correct. 

Mr. Quam. I think most of the States have moved. There may be 
one left who does not have that requirement, but everybody else 
now has legal presence as a requirement. 

Senator Collins. Do any of the other panelists know the answer 
to that question? Mr. Baker. 

Mr. Baker. I am under the impression that New Mexico and per- 
haps Hawaii still have not gone to that. 

Senator Collins. That is something that we will check with the 
Department for the record. 

I know my State of Maine was one of the last. The governor re- 
cently vetoed a bill that would have repealed the requirement for 
showing of legal presence, and I salute the governor for doing so 
because I think that is a fundamental reform. 

I am, however, sympathetic to the situation Mr. Quam described 
because we have had situations in Maine because of our close asso- 
ciation with Canada where the great grandmother came over from 
Canada many years ago, decades ago, married an America, thought 
that made her a citizen and does not have proof of her being born 
just across the border in New Brunswick. So it can be a difficult 
issue. 

I still think a requirement for legal presence is extremely impor- 
tant and that we should not be giving drivers’ licenses to people 
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who are here illegally, but it does get more complex when one tries 
to comply with the law. 

Let me ask one final question, and that is to Mr. Baker, and I 
want to go back to the commercial aircraft boarding issue because 
I am truly troubled by creating that loophole and how it would 
work in real-life application. 

In addition to creating the possibility for endless litigation, my 
concern is that security officials are increasingly being trained in 
behavioral recognition techniques like those that the Israeli Gov- 
ernment has used for airport security for decades and very success- 
fully. So an individual may present himself at the airport without 
a compliant ID, go through secondary screening, and there are no 
obvious red flags. He is not on the terrorist watch list. He is not 
carrying anything that a wand picks up as contraband. Yet, 
through the training the security guard has in behavioral recogni- 
tion techniques, the guard may believe that this individual poses 
a risk. 

Under the provisions of the PASS ID legislation with the prohibi- 
tion against denying the individual to the plane solely because he 
does not have a compliant ID, are you concerned that the guard 
would not have grounds to deny the individual access to the air- 
plane, Mr. Baker? 

Mr. Baker. I am. As we know, there is a good chance that the 
Capitol Building is still standing precisely because the 20th hi- 
jacker was turned away in Orlando by a border official who said 
he just gave me a creepy feeling, and I was not going to let him 
in. 

We really need to be able to let people use their judgment, their 
discretion. It is critical, as the Israelis say, that we look for terror- 
ists, not just for weapons. 

I predict that once we write this into law the courts will be asked 
to enforce it. People who don’t bring IDs will say: I missed my 
flight. I was denied boarding because I was sitting there, cooling 
my heels and answering your questions. So I have been denied 
boarding, and I was cooling my heels because I did not have an ID. 

By the same token, I think the courts will say: Well, OK, we 
have to make sure that this is not a pretext, that they are not just 
making up a creepy feeling to deny him boarding because he did 
not have ID. So we are going to have to do a searching inquiry into 
what the reasons are, and some reasons are good enough, and some 
reasons are not. 

I think you cannot overestimate the impact that it has on a rel- 
atively low paid employee to have a Federal judge questioning his 
motives and telling him he did his job wrong. No one wants to go 
through that. And all of those things are going to be a real damper 
on doing the kinds of searching inquiry we want TSA to do. 

Senator Collins. I want to make clear that I am not talking 
about irrational prejudices. I am not talking about profiling. I am 
talking about a trained security guard using this specific technique 
that has been used in Israel for many years and which is being 
used today in some of our airports. I believe Logan in Boston is one 
of those airports that is using the technique. So this is a trained 
guard’s assessment. 
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And my concern is, I think, the burden of proof is shifting from 
the individual presenting himself at the airport who has to prove 
that he is who he says he is to the security guard to prove that 
he is not the person he says he is. That really concerns me. 

So I hope that all the members of this panel will work further 
with us to help us sort this issue out. It is the reason that I did 
not join as a co-sponsor of this bill, because I felt so strongly that 
this undermines the security and the purpose of having a secure 
identification. 

So I do look forward to working with our panels, to working with 
the sponsor of the bill, and I want to thank you. Senator Akaka, 
for your leadership, and I want to thank the panel. 

Senator Akaka, I know that if Senator Lieberman were here he 
would say that the hearing record is going to remain open for an- 
other 15 days for the submission of any questions or additional ma- 
terials, and I am going to turn it over to you and thank you for 
your leadership. 

I want to thank all of our witnesses today. Thank you. 

Senator Akaka. Thank you very much. I want to thank our 
Ranking Member who has provided great leadership in this area 
and thinking into some of the issues that we have been facing and 
has been so helpful in doing that. 

Mr. Schwartz, Mr. Baker’s testimony suggests that the REAL ID 
Act increased privacy protections and that the repeal of the REAL 
ID would lead to significantly more cases of identity theft. Over the 
years, as we have worked on oversight of REAL ID, the Center for 
Democracy and Technology has been an advocate for additional pri- 
vacy protections both in REAL ID and on other government issues. 

Would you address the contention that REAL ID adequately pro- 
tects privacy and why you believe that additional protections in- 
cluded in PASS ID are needed? 

Mr. Schwartz. Thank you. Senator Akaka. 

The issue in terms of whether REAL ID improves privacy, I 
think you can look it up in the record. You can look at it in the 
notice for proposed rulemaking that DHS put out while Mr. Baker 
was there, and you can look at the footnote that specifically says 
that they cannot add privacy controls into the regulations because 
the law removed the words, privacy and privacy and security pro- 
tection of personal information, specifically that were in the Intel- 
ligence Reform Act. 

So, while I do think that DHS did take steps to say we are sup- 
posed to protect security and therefore we are going to build in 
some privacy protections about personal information, they did not 
go as far as they would have, even according to DHS, as if they 
had these privacy protections built in. 

I think that it was clear, when I served on the negotiated rule- 
making, that we were moving in the direction of coming to the 
right balance there. But when REAL ID came and overturned that 
committee from its work and that committee’s work, it took us 
many steps back from privacy protections that would have been in 
place. 

So I do think that while you can say that license reform would 
protect privacy, I do think that is true, and that is why we support 
license reform. And there are some privacy groups that are more 
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skeptical of license reform than the Center for Democracy and 
Technology is. 

We still feel that the move toward license reform is important, 
that even if we were going to repeal it, it should be replaced with 
another process of negotiated rulemaking. Senator, as you had in 
your last bill or put the privacy protections into law as you do in 
PASS ID. So that is why we support those provisions, but this idea 
that REAL ID would be better than those other two solutions, 
PASS ID or the original negotiated rulemaking, I think is just 
demonstratably false just based on what DHS has written about it 
directly. 

Senator Akaka. Mr. Schwartz, I would like to ask you about an 
especially important issue that was magnified by the enactment of 
REAL ID. This is the issue of how to protect the personally identifi- 
able information on the machine-readable zone of drivers’ licenses 
and identification cards. 

The Center for Democracy and Technology has been a longtime 
advocate for additional protection for this information which was 
put into a common machine-readable format through REAL ID. I 
understand that there were concerns that eliminating the ability to 
store electronic data from licenses could be detrimental to fraud 
and identity theft prevention. Would you please address this issue? 

Mr. Schwartz. Sure. I discussed this a little bit with Senator 
Collins earlier in response to her question about the fraud exemp- 
tion, but just taking this a step further I think that we should look 
at what is allowed under PASS ID. 

Under PASS ID, any retailer is allowed to take the license and 
swipe it and to do a comparison to check to make sure this is a 
real drivers’ license that was issued by a State. So they can do 
that. 

They can check and make sure that the information in the ma- 
chine-readable zone that they have in their database and to do a 
check immediately on that, that it is the same person. 

The only thing they cannot do is take it and swipe that informa- 
tion and store it in the database. It is the ease of aggregation of 
that data that represents the concern, especially as we know that 
we are getting the ability to put more and more information into 
the machine-readable zone. 

Today, it is one thing to say, well, most States only have the in- 
formation that is on the front of the card in the machine-readable 
zone. In the future, that is not going to be the case. So the real 
concern is in making sure that while we have this opportunity to 
discuss security on the card and standards for security on the card, 
that we are also looking into the future and saying that as we put 
more and more information into the machine-readable zone we are 
going to make sure that information is secure. 

That information to cardholders is of more concern because you 
can see what is on the front of the card. You cannot see what is 
in the machine-readable zone. So, when you give it to someone and 
you know that they can only use the front of the card to type in 
information or to scan that, you know that they are only using that 
information. It is a technological protection to say that if the per- 
son swipes the card they can only read the same information that 
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is on the front of the card, and that is what we should be focused 
on. 

There is also the security threat of turning over more and more 
information from swiping the card to many individuals. I had a 
conversation recently with Vivek Kundra who is now the Federal 
Chief Information Oficer (CIO), who used to be the CIO of Wash- 
ington, DC. He was telling me that while he was in Washington 
he put out a number of fraud-prevention measures where to ensure 
that DMV workers could only do a check against the database, and 
so they could only verify the information in the database. That was 
the security and the privacy protections put in place to limit the 
amount of information that a DMV worker could find out about the 
information. 

Those same types of rules should go into effect for other people 
that have to use the drivers’ license and when they want to use 
that machine-readable zone. 

Senator Akaka. Thank you. 

Mr. Baker, your testimony asserts that PASS ID would return us 
to pre-September 11, 2001, standards for the issuance of identifica- 
tion documents. However, the PASS ID Act actually contains many 
of the same security requirements as REAL ID including require- 
ments to provide a photo identity document, documentation show- 
ing the person’s date of birth, proof of the person’s Social Security 
number, documentation showing the person’s name and address of 
principal residence and proof that an individual is in the country 
lawfully. 

Under PASS ID, Social Security numbers and lawful presence 
would be checked electronically. As with the U.S. passports, identi- 
fication documents would be validated or authenticated rather than 
verified with the issuing agency. None of these Federal standards 
were in place pre-September 11, 2001. 

What is the basis for your claim that PASS ID would move 
States back to pre-September 11, 2001, standards? 

Mr. Baker. I certainly do not mean to suggest that the items 
that PASS ID requires are not useful. I think they are very useful. 
By and large, they are the 18 elements that we thought should be 
done as part of material compliance. 

One of the big deadline problems is that under REAL ID, mate- 
rial compliance (meaning those 18 items) is due to be completed at 
the end of this year. You might have to give States some additional 
time because of the crisis that they find themselves in, but States 
knew that was the deadline. They were working toward it, and 
there were no States that told us they could not do it. Even the 
ones who said, “we reject REAL ID,” nonetheless, also said they ex- 
pected to be able to do the substance of those 18 items. 

What PASS ID does is, it says: You know those 18 items? Do 
them in 2016, and maybe not even then if there is some litigation 
or delay over delivering the regs. 

Well, that is a terribly long delay for something that most States 
are close to being able to do now. We should not accept what I 
think will be much more than 5 years of delay, and that does mean 
that for the next 5 or 6 years we are getting nothing that we did 
not have. 
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You talked about the electronic checks that are done. I think 
those are useful, but again the lack of ambition is astonishing. We 
have an E-Verify program for employers that the two Administra- 
tions have now embraced. They said people who get money, who 
are contractors should follow E-Verify. They should check the So- 
cial Security number to make sure it matches the name. Then if 
they do not match, you do not get the job. 

Well, there is nothing in here that says you do not get your li- 
cense if your name and your Social Security number do not match. 
We have to at least have the same standards that we have for E- 
Verify. People should be required to produce the DHS ID if they 
are not American citizens but they are authorized to work. If they 
produce a passport, the States should check just as every employer 
is going to check to see if the photos on the passport match. 

Those are systems that are available now or about to be rolled 
out. There is no need to say, I am not sure it will work. It is work- 
ing today for 150,000 employers, and the States should go through 
that same process. This bill does not require them to do as much 
as employers are doing today. 

So, in those respects, I think we have stepped substantially back 
from REAL ID. I do not mean to say that there is nothing here. 

We did not, however, because we did not deal with source docu- 
ments, address the problem that the 9/11 Commission was most 
concerned about, which was the hijackers getting legitimate IDs by 
using fake documents. Thank you. 

Senator Akaka. Well, thank you very much for your response. 

I would like to ask Mr. Quam whether he has any comments 
about this. 

Mr. Quam. Thank you. Senator. 

I think Mr. Baker grossly underestimates the States. 

One, to say that somehow all this will not be done until 2016 
makes absolutely no sense. States are going to need every single 
minute of a 5-year window to bring 245 million drivers back in to 
get PASS IDs. They are not waiting until the end. They want a 
system in place that creates the certainty, so they can make the 
investments and they can start the process, and they want to do 
it as soon as they possibly can. No one is waiting. 

SAVE and SSOLV are verification systems that are not used 
today. Well, they are used by several States, but this would require 
all of them to use SAVE and SSOLV. 

The fact of the matter is that PASS ID took the best parts and 
most workable parts of REAL ID and brought them over. He is ex- 
actly right about that. And it is because governors were interested 
in finding the solution, not starting at zero, but starting at where 
we are, take what works and then actually get the job done. 

I actually believe that States are going to aspire to do better 
than PASS ID. PASS ID will set a floor that States will go beyond. 
I think States will participate vigorously in the pilot program. I 
think they want to find solutions. They would like nothing more 
than to have these systems that protect the privacy, that can add 
to the verification, that are robust, reliable, and push-button, so 
that you can actually get citizens through that line quickly, and 
they know that the ID that they are given represents exactly who 
they are. 
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We all share that common goal. To say that we do not is mis- 
leading. 

I think States are on a page where PASS ID offers solutions. It 
offers more verification. And, because it can he done, PASS ID 
meets the 9/11 Commission recommendations where REAL ID ac- 
tually fails. 

Senator Akaka. Well, thank you very much. 

Are there any other comments from our other two panelists? 

If not, I want to thank you so much. This has heen helpful. 
Thank you for your support and all that you have done. I want to 
especially thank you for working with our staff to put this hearing 
together, and I want to thank you again for moving us this far. 

Without question, we are going to have to move on this as quick- 
ly as we can, and we will try to do that. 

So the hearing record will he open for 15 days until July 30 for 
the submission of statements and questions for the record. 

Again, thank you very much. The hearing is now adjourned. 

[Whereupon, at 12:40 p.m., the Committee was adjourned.] 
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Opening Statement for Chairman Joseph Lieberman 
Homeland Security and Governmental Affairs Committee 
“Identification Security: Reevaluating the REAL ID Act” 

Washington, DC 
July 15, 2009 

Good morning and welcome to this hearing, where we will review the steps that the 
United States Government has taken, and that state governments have responded to, and that we 
might ultimately take to achieve the important national goat of keeping fraudulent state 
identification cards and drivers licenses out of the hands of terrorists and criminals. 

I want to welcome Secretary Napolitano, Governor Douglas of Vermont, and our other 
witnesses on the second panel, and thank you for all the work that you have done on this 
important matter. 

I regret to say that I’m not surprised we are here today. When Congress adopted the so- 
called REAL ID Act of 2005 as an amendment to a supplemental appropriations bill— without 
hearings of any kind or any formal public vetting - we replaced a process for developing federal 
identification requirements that Senator Collins and I had made part of the Intelligence Reform 
and Terrorism Prevention Act of 2004, the so-called 9/1 1 Commission legislation. 

In our work, Senator Collins and I took very seriously the finding of the 9-11 
Commission that: “All but one of the 9/1 1 hijackers acquired some form of U.S. identification 
document, some by fraud. Acquisition of these forms of identification would have assisted them 
in boarding commercial flights, renting cars, and other necessary activities.” The 9/1 1 
Commission went on to appeal to the federal government “set standards for the issuance of birth 
certificates and sources of identification, such as driver’s licenses.” With that in mind, we 
therefore included in the 9/1 1 legislation of 2004 a requirement that the federal government 
establish a negotiated rulemaking committee composed of subject matter experts and 
stakeholders, including, of course, representatives of the states governments, to propose 
workable identification security standards. 

Then came the REAL ID Act of 2005, which was submitted as an amendment to 
supplemental appropriations legislation. Though I thought some of the parts of the act and the 
intention of the act were good, I opposed the REAL ID Act because I ultimately thought it laid 
out a very prescriptive, unworkable and expensive process - and unfortunately history has borne 
this out and that is why we are here today, if 1 may rub it in a little bit I really believe that if our 
original 9/1 1 Commission legislation had been left intact and a rulemaking process had begun 
and it hadn’t been repealed by REAL ID, we’d have millions more security IDs today instead of 
being involved in a continuing debate and really a joust between the states and the federal 
government. 

Some states, including Connecticut, are w'orking to implement REAL ID, but the fact is 
that the legislatures of 13 states have passed laws prohibiting their states from complying with 
REAL ID as it is presently stands — and several other slates are considering similar legislation. 
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That is at the risk that their state identification documents will not be accepted by the federal 
government, for instance for boarding a plane. 

That is crisis that brings us here today as we try and answer the question of: what kinds of 
changes to REAL ID are necessary to achieve a workable solution? 

As always in the Congress, we cannot let the perfect be the enemy of the good, but of 
course we want to ensure that what we consider to be “good” is not diluted so that we in any way 
compromise our homeland security, 1 personally believe we can accomplish both goals. 

Today we will discuss bi-partisan legislation sponsored by a number of members of this 
committee- Senators Akaka, Voinovich, Carper, Tester, and Burris - which is called the PASS 
ID Act that reforms REAL ID in an attempt to make it work as intended while trying to ease the 
strain on our overburdened and underfunded state governments. 

The plan retains parts of REAL ID, such as the requirement of a digital photograph and 
signature and machine-readable coding on state-issued ID cards. And states will still also need to 
verify an applicant’s Social Security number and legal status by checking federal immigration 
and Social Security databases. 

But, the states would also be given more flexibility in issuing the new identification cards 
while staying. I’m pleased to say, within the REAL ID timetable. In fact, if PASS ID becomes 
law this year, states must be fully compliant with it before the current REAL ID deadline of 
2017, 

That is important, I’m sure to all of us, because, any acceptable solution must really work 
within existing timetables and not delay increased personal identification security. 

PASS ID does eliminate a requirement that motor vehicle departments electronically 
check the validity of some identity documents, such as birth certificates, with the originating 
agency. I know this change has been a major source of concern. This morning, I want to discuss 
it with some of our witnesses to see whether the concerns are justified, 

PASS ID also strengthens privacy protections by requiring procedures be put in place to 
prevent the unauthorized access or sharing of information; to require a public notice of privacy 
policies; and a process for individuals to correct their records. 

So let me thank Senators Akaka, Voinovich, and others who joined them - as well as the 
Secretary - for the efforts that you have made in coming up with a plan that can work while not 
losing sight of the very direct statement of the 9- 1 1 Commission warning us that - and I quote - 
“for terrorists, travel documents are as important as weapons." 

I still do have some concerns about PASS ID that I want to explore with our witnesses 
today. But bottom line, in an age of terrorism, reliable personal identification is an important and 
urgent matter critical to our homeland security. 1 hope that this hearing will enable us to move 
forward and mark up legislation in this committee on this matter in the very near future. 
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Opening Statement of 
Senator Susan M. Collins 

“Identification Security: Reevaluating the REAL ID Act” 

Committee on Homeland Security and Governmental Affairs 
July 15,2009 

★ ★ ★ 

One week from today, we mark the fifth anniversary of the release of the bipartisan 
9/11 Commission Report. In examining how terrorists were able to attack America, the 
Commission found that all but one of the 19 terrorists used drivers’ licenses to board the 
planes that were used as weapons in the attacks that killed nearly 3,000 people. 

The commissioners recognized that easily obtained drivers’ licenses were a security 
vulnerability, stating, “For terrorists, travel documents are as important as weapons.” 

And to address this vulnerability, the Commission recommended that the federal 
government set standards for the issuance of birth certificates and other sources of 
identification, particularly drivers’ licenses which had proven vital to the terrorists’ ability 
to carry out their deadly plot. 

To call the effort to implement this recommendation “difficult” would be an 
understatement. Senator Lieberman and I authored provisions in the Intelligence Reform 
Act of 2004 that established a collaborative committee comprised of federal and state 
officials, technology experts, and privacy advocates to develop these secure identification 
standards. Regulations were already being developed in early 2005 when, unfortunately, 
the House of Representatives repealed these provisions by slipping the REAL ID Act into 
an urgent war funding bill. 

Then, for more than two years, states were left to contemplate the enormity of the 
task of reissuing new licenses to all drivers by May 2008 while they waited for the 
Department of Homeland Security to issue the regulations that would tell them how to 
achieve that requirement. And they waited... and waited... and waited... until January 29, 
2008, when a final rule was issued, leaving the states just 103 days until the May 11, 2008, 
complianee deadline set by the Act. 

Complicating the problem, state budgets had little room for the hundreds of 
millions of dollars it would eost to implement these regulations - and a faltering economy 
only worsened the financial strain. Another problem was that key information technology 
systems necessary to implement the law efficiently were not readily available. 
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And although identity theft costs the economy billions of dollars and causes much 
distress to its victims, the Department’s regulations failed to address critical privacy issues 
created by the interconnected systems of databases mandated by the law. 

With these problems unresolved and numerous state legislatures protesting REAL 
ID - or even outright refusing to implement the program - 1 worked to persuade the 
Department to provide states an additional 18 months to meet the REAL ID deadline, 
giving us all time to revisit this issue. 

The PASS ID Act that we are discussing today is one attempt to resolve the 
problems I have described. It refines rather than repeals the law and targets areas where 
that law imposed unreasonable and costly burdens on states, failed to protect the privacy 
interests of our citizens, and mandated technical solutions that may not be practical. 

One example of these refinements is in the bill’s approach to ensuring that each 
person possesses only one valid license ... from any one state ... at any one time. To meet 
this goal, REAL ID would have mandated an information sharing system that may not be 
technically feasible or governed by any basic privacy protections. Instead of scrapping this 
system altogether, PASS ID would preserve and fund a pilot program to test necessary 
technology and to permit a careful examination of privacy concerns. This makes sense. 

Nonetheless, I recognize the concerns of those who fear that this bill, in addressing 
problematic portions of the REAL ID Act, may have unintended consequences. Drivers’ 
licenses can be the “keys to the kingdom” for terrorists bent on death and destruction, and 
states have a responsibility to ensure licenses are tamper-proof and issued only to people 
whose identity and legal status can be verified. 

Certain language in the PASS ID Act may undermine that goal because it would not 
allow TSA to prevent a passenger from boarding a plane based “solely” on the fact that he 
or she did not have a compliant license. This provision would eliminate an important 
incentive for states to adopt federal standards for secure licenses and could impose 
worrisome restrictions on the discretion of security officials who believe a passenger 
without a compliant card should not be permitted to board a plane. 

As we examine this legislation today, my primary concerns are whether these 
provisions are moving us toward the security goal set by the 9/11 Commission five years 
ago while accommodating the legitimate concerns of states and privacy experts. 

Specifically, I would like the witnesses to address the following questions: 

• Do the provisions of the PASS ID Act create secure licenses that can be kept out of 

the hands of future terrorists who could use them - as the 9/1 1 hijackers did - to 

move freely within the United States? 
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• How much will it cost to implement the PASS ID Act, and how much of the cost 
should the federal government assume? 

• Does the PASS ID Act include sufficient privacy protections to ensure that personal 
information is protected from theft and abuse? 


Today, we roll up our sleeves and once again dig into the work of ensuring that 
states issue secure licenses - a protection recommended by the 9/11 Commission and one 
that we owe the American people. 


### 


q 
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“Identification Security: Reevaluating the REAL ID Act” 
Statement of Senator Daniel K. Akaka 
Committee on Homeland Security and Governmental Affairs 
July 15, 2009 


Mr. Chairman, 1 want to thank you for holding this hearing to further explore the ramifications of REAL 
ID on States, on security, and on privacy, as well as the proposal that I, along with Senator Voinovich, 
Carper, Tester, Burris, and other Members, have put forward to fix REAL ID. 

1 have been a long-time opponent of REAL ID due to concerns about protecting individuals’ privacy, as 
well as the States’ inability to implement the burdensome program. REAL ID calls on States to collect 
and electronically store individuals’ personal records when issuing licenses and to share that information 
with every Department of Motor Vehicles nationwide. This effectively would create a national database 
containing massive amounts of personal information. 

During the last Congress, I chaired two hearings on REAL ID where it became clear that it was simply 
not workable. Some of the data systems do not yet exist because so many States have balked at the high 
costs and privacy implications of creating such a system. If REAL ID is implemented, these databases 
could provide one-stop shopping for identity thieves and become the backbone for a national 
identification card. 

We must act to fix REAL ID. States simply still cannot afford the $4 billion it would take to implement 
REAL ID. Over a dozen States have already refused to comply, and several more, like Hawaii, have 
expressed serious concerns with the program. Without the participation of all States, there will be only a 
patchwork system for identification security, which means no real security at all. 

The bill I am proposing, S. 1261, the Providing for Additional Security in States’ Identification Act of 
2009, or PASS ID Act, represents a pragmatic approach to resolving many of the most troubling aspects 
of the REAL ID Act. I worked closely with stakeholders, many of whom are here today, representing a 
broad range of views, to develop this practical alternative to REAL ID. 

The PASS ID Act does exactly what the 9/1 1 Commission recommended: it sets strong security 
standards for the issuance of identification cards and driver’s licenses, What it does not do is go far 
beyond that recommendation by requiring the collection of Americans’ personal information and storing 
it in a centralized repository accessible by any State DMV. 

Perhaps the most important improvement in our bill is the removal of the mandate that States share all of 
their driver’s license data with each of the other States. This provision created a clear threat to the 
privacy of all Americans’ personal information, posed a great risk for identity theft and fraud, and raised 
the specter of a national database of all Americans’ personal information. 

The bill requires States to protect electronic information and, for the first time, any machine readable 
data stored on identification cards and driver’s licenses themselves ensuring it is only used for its 
intended purposes. 
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Another change that I want to highlight is the clarification of Americans’ right to travel on commercial 
aircraft and to enter Federal buildings. The current law restricts these rights by requiring a REAL ID 
compliant ID to board commercial aircraft and to enter federal buildings. 

In this country, we cherish the right to travel and the right to petition the government. Americans should 
not be denied boarding an aircraft or denied entry to most federal buildings solely because they have 
lost, or do not have, their identification. Instead, such situations should be resolved through additional 
security screening or other inquiries as needed, as is currently TSA policy and is the case with every 
other type of security risk. 

As important as what would change with PASS ID is what would not change. Individuals would still 
need to prove that they are lawfully present in the United States, individuals would only be allowed one 
compliant identification to be used for official purposes, and individuals would need to present the same 
sources of identifying documents to obtain a compliant license. 

This compromise bill does not address all of my concerns with REAL ID. I know that others are 
disappointed that it does not address all of their concerns. However, the reality that we face right now is 
that in less than a year, States will be required to comply with a law that is overly burdensome and 
unworkable. We cannot let the perfect be the enemy of the good, especially when we are working to 
address a seriously flawed law already on the books. 

To date, the Department of Homeland Security, the National Governors Association, National 
Conference of State Legislatures, the Center for Democracy and Technology, and several law 
enforcement organizations have endorsed PASS ID. I hope we will move swiftly to ensure its 
enactment and provide some clarity to States facing REAL ID implementation deadlines. 

As always, my goal remains to protect both the security needs and the privacy rights of all Americans, 
and I will continue to work closely with the Department of Homeland Security to ensure that individual 
rights and liberties are fully protected during the implementation of PASS ID. 

I thank you again. Chairman Lieberman and Ranking Member Collins, for agreeing to hold this hearing. 

I ask that my full statement from the introduction of PASS ID be included in this hearing's record. 


-END- 
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Statement of Senator Daniel K. Akaka 
Introduction of the 

Providing for Additional Security in States’ Identification Act of 2009 
(PASS ID Act) 


Mr. President, today I am, along with Senators Voinovich, Leahy, Tester, Baucus, and 
Carper, introducing the “Providing for Additional Security in States’ Identification Act of 2009,” 
or the “PASS ID Act,” 

This bill represents a pragmatic approach to resolving many of the most troubling aspects 
of the REAL ID Act, which has been in place for the past four years. REAL ID was intended to 
implement the 9/1 1 Commission’s recommendation for enhancing the security of drivers’ 
licenses. I support the 9/1 1 Commission’s recommendation, but I have been a long-time 
opponent of the existing REAL ID Act due to the tremendous financial burden it imposes on 
States and the serious privacy risks it creates. 

Initially, DHS estimated the cost of implementing REAL ID to be $23 billion, of which 
$14 billion would be borne by the States. In the final regulations, DHS’s overall cost estimate 
decreased to $10 billion, $4 billion of which States would have to pay. Many States are facing 
serious budget shortfalls and simply caimot afford this cost. 

Additionally, REAL ID calls for all States to store copies of individuals’ documents such 
as birth certificates and their photographs in databases and to provide all other State Departments 
of Motor Vehicles with access to that information, REAL ID does not require any privacy 
protection of these State databases, which would contain massive amounts of personal 
information. These databases could provide one-stop shopping for identity thieves and the 
backbone for a national identification database. 

Because of these problems, the Department of Homeland Security has been forced to 
provide a series of extensions for compliance. All 50 States plus the District of Columbia and 
the territories were granted extensions until December 3 1 , 2009. DHS may automatically grant 
States further extensions to May 1 1, 201 1, if they meet certain benchmarks for compliance. 
Under the final regulations, complete implementation is required by December 1, 2017. Even 
under this drawn out timeline, it is unclear if many States will comply. Several States, including 
Hawaii, have passed resolutions expressing their opposition to REAL ID. Eleven States have 
outright rejected REAL ID, putting millions of Americans at risk of not being able to enter 
Federal facilities or board commercial airplanes next year if they do not meet DHS benchmarks. 
Americans’ personal information could also be compromised if REAL ID were to fully take 
effect in its current form. This simply cannot be allowed to happen. 

Because of my grave concerns with the REAL ID program, during the last Congress, I 
along with several of my colleagues introduced the Identity Security Enhancement Act, which 
would have repealed the REAL ID Act and replaced it with a negotiated rulemaking process that 
would have enhanced the security of State driver’s lieenses while also providing for strong 
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privacy protections. Unfortunately, this bill did not advance, and we are now closer than ever to 
forcing states to ensure compliance with REAL ID. 

1 along with my colleagues, the Department of Homeland Security, privacy and civil 
liberties groups, and the National Governors Association and National Council of State 
Legislators - representing a broad range of views on REAL ID - have been working together to 
develop a bill that will address the onerous problems with REAL ID in a practical manner that 
can win bipartisan support. I believe that the bill we are introducing represents a pragmatic 
alternative to REAL ID, which will save States considerable money and address the most 
troubling aspects of the REAL ID Act. 

The PASS ID Act does exactly what the 9/1 1 Commission recommended: it sets strong 
security standards for the issuance of identification cards and driver’s licenses. What it does not 
do is go far beyond that recommendation by requiring the collection of Americans’ personal 
information and storing it in a centralized repository accessible by any State government. This 
legislation starts with repealing the existing flawed REAL ID Act, and replaces it with a 
modification of the original act that peels away the most troubling aspects that add high costs 
without real security benefits, and implements strong new protections to protect the privacy 
rights of individuals. 

Perhaps the most important improvement in the PASS ID Act is the removal of the 
mandate that States share all of their driver’s license data with each of the other States. This 
provision created a clear risk to the privacy of all Americans’ personal information and posed a 
great risk for identity theft and fraud. Moreover, it was this provision that raised the specter of a 
national database of all Americans’ personal information. The PASS ID Act instead will allow 
States to continue to maintain their own individual databases with more stringent security 
requirements. 

In addition, the PASS ID Act includes all of the privacy protections called for in my 
previous bill, the Identity Security Enhancement Act. The bill calls on the States to put 
procedures in place to protect information that is stored or transmitted in an electronic format. 
The bill also for the first time protects any machine readable data stored on identification cards 
and driver’s licenses themselves. In particular. Social Security numbers, which are not allowed 
to be printed on the face of a license, would no longer be allowed to be stored in the machine 
readable zone (MRZ) of a license either. 

Because of the ability of licenses to hold more and more electronic information, it is also 
important to institute important new protections for the use of the data stored on licenses. A new 
industry is growing up surrounding the collection and sale of data stored in MRZs for marketing 
purposes. Often people are not informed that their personal information is being collected and 
might be tracked with their purchases or sold to third parties. This bill would allow scanning of 
licenses to support law enforcement purposes but not for other purposes. For example, a store 
would be able to scan a driver’s license to double check that the patron is old enough to buy 
alcohol, but it would not be allowed to sell the information on the card to marketers. This is an 
important step forward to ensure that privacy and security protections keep pace with 
technology, while still ensuring that the MRZ can be used for its intended purposes. 
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The other change that I want to point out is the clarification of Americans’ right to travel 
on commercial aircraft and to enter Federal buildings. The current law restricts these rights by 
requiring a REAL ID to board commercial aircraft and to enter federal buildings. This bill 
recognizes the importance of secure identification to increase the safety and security of 
commercial air travel and a narrower range of federal buildings. Compliant State identification 
will remain the preferred method to board an aircraft, but the PASS ID Act will clarify that 
people cannot be denied boarding solely because they lack secure identification. The 
Transportation Security Administration will resolve any security concerns with people lacking a 
PASS ID the same way they resolve other security issues - with additional screening or other 
inquiries as needed. Additionally, PASS ID would narrow the secure identification requirement 
from all federal buildings to only federal facilities containing mission functions critical to 
homeland security, national security, or defense. 

This bill does not address all of ray concerns with REAL ID. Some others will be 
disappointed that it does not address all of their concerns. However, the reality that we face is 
that in less than a year, States will be required to comply with a law on the books that simply is 
overly burdensome and unworkable. I believe that the legislation introduced today is the best 
bill that can gamer broad bipartisan support. It represents a strong step toward fixing the most 
serious shortfalls in the REAL ID Act and would introduce long-overdue, important new 
protections. We cannot let the perfect be the enemy of the good, especially when we are 
working to address a seriously flawed law already on the books. 

I urge my colleagues to talk to your Governors and other State government officials, your 
constituents, and to privacy experts to understand just how much this legislation does to improve 
existing law. By taking the time to work with all stakeholders, I think that we have achieved a 
solution that leaves us much better off than we are today. 

As always, my goal remains to ensure the privacy rights of all Americans, and I will 
continue to work closely with the Department of Homeland Security to ensure that privacy rights 
are protected fully during the implementation of PASS ID. 
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II 


niTH CONGRESS ^ I 1 

1st Session j I 

To repeal title II of the REAIj ID Act of 2005 and amend title II of 
the Homeland Security Act of 2002 to better protect the security, con- 
fidentiality, and iiitegi-ity of personally identifiable information collected 
by States when issuing driver’s licenses and identification documents, 
and for other purposes. 


IN THE SENATE OP THE UNITED STATES 

June 15, 2009 

Mr. Akaica (for himself, Mr. Voinoyicii, Mr. Leatty, Mr. TesTEB, Mr. Bau- 
cUiS, and Mr. Carper) introduced the following bill; which was road twice 
and referred to the Comniitlee on Homeland Security and Governmental 
Affairs 


A BILL 

To repeal title II of the REAIj ID Act of 2005 and amend 
title II of the Homeland Security Act of 2002 to better 
protect the security, confidentiality, and integrity of per- 
sonally identifiable information collected by States when 
issuing driver’s licenses and identification documents, 
and for other puiposes. 

1 Be it enacted by the Senate and House of Representa- 

2 tines of the United States of America in Congress assembled, 
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2 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the “Providing for Addi- 

3 tional Security in States’ Identification Act of 2009” or 

4 the “PASS ID Act”. 

5 SEC. 2. REPEAL. 

6 Title II of the REAI. ID Act of 2005 (Division B 

7 of Public Law 109-13) is repealed. 

8 SEC. 3. IDENTIFICATION SECURITY. 

9 (a) In GENERiVL. — Title II of the Homeland Security 

10 Act of 2002 (6 U.S.C. 121 et seq.) is amended by adding 

11 at the end the following: 

12 “Subtitle E — Improved Security for 

13 Driver’s Licenses and Personal 

14 Identification Cards 

15 “SEC. 241. DEFINITIONS. 

16 “In this subtitle: 

17 “(1) Driver’s license. — T he term ‘driver’s li- 

18 cense’ means a motor vehicle operator’s license, as 

19 defined in section 30301 of title 49, United States 

20 Code. 

21 “(2) Identificution card. — T he term ‘identi- 

22 fication card’ means a personal identification card, 

23 as defined in section 1028(d) of title 18, United 

24 States Code, issued by a State. 

25 “(3) M.\teriaIjLY compijant. — ^A State is 

26 ‘materially compliant’ if the State has certified to 

•S 1261 IS 
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3 

1 the Seeretaiy that the State has commenced issuing 

2 driver’s licenses and identification cards that are 

3 compliant with the requirements of this subtitle. 

4 “(4) Official purpose. — The term ‘official 

5 purpose’ means — 

6 “(A) accessing Federal facilities that eon- 

7 tain mission functions critical to homeland se- 

8 eurity, national security, or defense; 

9 “(B) accessing nuclear power plants; or 

10 “(C) boarding federally regulated commer- 

1 1 cial aircraft. 

12 “(5) Secretary. — The term ‘Secretary’ means 

13 the Secretary of Homeland Security. 

14 “(6) State. — The term ‘State’ means a State 

15 of the United States, the District of Columbia, Puer- 

16 to Rico, the Virgin Islands, Guam, American Samoa, 

17 and the Commonwealth of the Northern Mariana Is- 

1 8 lands. 

19 “SEC. 242. MINIMUM DOCUMENT REQUIREMENTS AND 

20 ISSUANCE STANDARDS FOR FEDERAL REC- 

21 OGNITION. 

22 “(a) Minimum Standards for Federal Use. — 

23 “(1) In general. — Beginning 1 year after the 

24 date on which final regulations are issued to imple- 

•S 1261 IS 
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4 

1 ment this subtitle, pursuant to section 5 of the 

2 PASS ID Act— 

3 “(A) a Federal agency may not accept, for 

4 any official purpose, a driver’s license or identi- 

5 fieation card issued by a. State to any person 

6 unless the State is materially compliant; and 

7 “(B) no person shall be denied boarding a 

8 commercial aircraft solely on the basis of failure 

9 to present a driver’s license or identification 

10 card issued pursuant to this subtitle. 

11 “(2) Agency acceptance. — Beginning 6 years 

12 after the date on which final regulations are issued 

13 to implement this subtitle, pursuant to section 5 of 

14 the PASS ID Act, a Federal agency may not accept, 

15 for any official purpose, a driver’s license or identi- 

16 fieation card unless the license or card complies with 

17 subsection (b). 

18 “(3) State certifications. — The Secretaiy 

19 shall determine whether a State is meeting the re- 

20 quirements of this section based on certifications 

21 made by the State to the Secretaire Such certifi- 

22 cations shall be made at such times and in such 

23 manner as the Secretary', in con.sultation wth the 

24 Secretaiy of Transportation, may prescribe by regu- 

25 lation. 

•S 1261 IS 
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5 

1 “(4) Certification op other identifica- 

2 TION DOCUMENTS. — The Secretary may certify any 

3 driver’s license or identification card, including an 

4 Enhanced Driver’s License designated by the Sec- 

5 retaiy under section 7209 of the 9/11 Commission 

6 Implementation Act of 2004, as compliant OTth the 

7 requirements of this subtitle if the Secretary, after 

8 rerdew, determines such license or card meets the re- 

9 quirements of this subtitle. 

10 “(b) Minimum Document Requirements. — T o 

11 meet the requirements of this section, a State shall in- 

12 elude, at a minimum, the folknving infonnation and fea- 

13 tures on each driver’s license and identification card 

14 issued to a person by the State: 

15 “(1) The person’s legal name. 

16 “(2) The person’s date of birth. 

17 “(3) The person’s gender. 

18 “(4) The person’s driver’s license or identifica- 

19 tion card number. 

20 “(5) A digital photograph of the person. 

21 “(6) The person’s address of principal resi- 

22 dence, except — 

23 “(A) as provided for under section 827 of 

24 the Violence Against Women Act (Public Law 

25 109-162); or 


•S 1261 IS 


VerDate Nov 24 2008 09:40 Jun 06, 201 1 Jkt 51792 PO 00000 Frm 000063 Fmt 06601 Sf ml 06601 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



60 
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1 “(B) for any indhadual who a State deter- 

2 mines should be exempted from the requirement 

3 under this paragraph to protect the safety or 

4 securit.y of the applicant. 

5 “(7) The person’s signature. 

6 “(8) A combination of security features de- 

7 signed to protect the physical integrity of the docu- 

8 ment, including the prevention of tampering, coun- 

9 terfeiting, or duplication of the document for fraudu- 

10 lent purposes. 

11 “(9) A common machine-readable technolog^^ 

12 containing the data elements available on the face of 

13 a driver’s license or identification card. A person’s 

14 social security number may not be included in these 

15 data elements. 

16 “(10) A unique SMnbol designated by the Sec- 

17 i'etar>' to indicate compliance with the requirements 

18 under this section. 

19 “(e) Minimum Issuance STANUiVRDs. — 

20 “(1) In GENER.AI.. — To meet the requirements 

21 of this section, for all driver’s licenses and identifica- 

22 tion cards issued under this subtitle at least 1 year 

23 after the date on which final regulations are issued 

24 to implement this subtitle, pursuant to section 5 of 

25 the PASS ID Act, a State shall require, at a min- 

•S 1261 IS 
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21 
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23 
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7 

imum, presentation and validation of the following 
information before issuing a driver’s license or iden- 
tification card to a person: 

“(A) A photo identity document, except 
that a non-photo identity document is accept- 
able if it includes both the person’s full name 
and date of birth. 

“(B) Documentation showing the person’s 
date of birth. 

“(C) Proof of the person’s social security 
account number or verification that the person 
is not eligible for a social security account num- 
ber. 

“(D) Documentation showing- the person’s 
name and address of principal residence. 

“(2) Specl\l requtkements, — 

“(A) In general.- — To meet the require- 
ments of this section, a State shall comply ivith 
the minimum standards of this paragraph. 

“(B) Eaudence of laavl’tjl status. — Be- 
fore issuing a driver’s license or identification 
card to a person, a State shall A-erify that the 
person — 

“(i) is a citizen or national of the 

United States; 
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8 

“(ii) has been granted lawful perma- 
nent residence in the United States; 

“(iii) has been granted asylum or 
withholding of removal, or has been admit- 
ted into the United States as a refugee; 

“(iv) has been granted temporary resi- 
dence in the United States; 

“(v) has been paroled into the United 
States under section 212(d)(5) of the Im- 
migration and Nationality Act (8 U.S.C. 
1182(d)(5)), subject to such exceptions as 
the Secretaiy, in the Secretaire’s 
unreviewable discretion, may prescribe for 
aliens paroled into the United States for 
prosecution or other categories of paroled 
aliens; 

“(vI) is a lawful nonimmigrant in the 
United States; 

“(vii) has a pending application for 
asylum or wdthholding of removal and has 
been granted emplojunent authorization; 

“(viii) has been granted temporary- 
protected status in the United States or 
has a pending application for temporary 
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9 

protective status and has been gi’anted em- 
ployment authorization; 

“(ix) has been granted deferred action 
status; 

“(x) has a pending application for ad- 
justment of status to that of an alien law- 
fully admitted for permanent residence in 
the United States or conditional perma- 
nent resident status in the United States; 

“(xi) has otherwise been granted em- 
ployment authorization in the United 
States; or 

“(xii) is otherwise an alien laAvfully 
present in the United States, as deter- 
mined bj^ the Secretary in the Secretary’s 
unre\iewable discretion. 

“(C) Temporary driver’s licenses and 

IDENTIFICATION CARDS. — 

“(i) In GENERATi. — If a person pre- 
sents evidence under any of clauses (iv) 
through (xii) of subparagraph (B), the 
State may only issue a temporary' driver’s 
license or temporarj'^ identification card to 
the person that is valid for a time period 
ending not later than the expiration date 
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of the applicant’s avithorized stay in the 
United States or, if there is no such expi- 
ration date, for a period not to exceed 1 
year. The Secretary may, in the Sec- 
retary’s iinreviewable discretion, authorize 
the issuance of temporai^^ driver’s licenses 
or temporary identification cards, for peri- 
ods longer than 1 year, to employees of 
international oi’ganizations and to other 
nonimmigrant aliens who are authorized to 
r'emain in the United States for an indefi- 
nite period. 

“(ii) DISPI.AY OF EXPIRATION 
DATE, — temporary driver’s license or 
temporary identification card issued pursu- 
ant to this subparagi-aph shall clearly state 
the date on which it expires. 

“(iii) RenewaTj. — A temporary’ driv- 
er’s license or temporary identification 
card issued pursuant to this subparagraph 
may be renewed only upon verification of 
the applicant’s current lawftil status. 

“(3) V.ALIDATION OF DOCUMENTS. — To meet 
the requirements of this section, a State — 
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11 

1 “(A) shall not accept any foreign docu- 

2 ment, other than an official passport, to satisfy 

3 a requirement of paragraph (1) or (2); and 

4 “(B) not later than 1 year after the date 

5 on which final regulations are issued to imple- 

6 ment this subtitle, pursuant to section 5 of the 

7 PASS ID Act, shall enter into a memorandum 

8 of understanding with the Secretary to rou- 

9 tinely utilize the automated s.ystem known as 

10 Systematic Alien Verification for Entitlements 

11 established under section 121 of the Immigra- 

12 tion Reform and Control Act of 1986 (Public 

13 Law 99-603), to verify- the legal presence sta- 

14 tus of a person, other than a United States cit- 

15 izen or national, who is applying for a driver’s 

16 license or identification card. 

17 “(d) Other Reqttire6IENTS. — To meet the require- 

18 ments of this section, a State shall adopt the following 

19 practices in the issuance of driver’s licenses and identifica- 

20 tion cards: 

21 “(1)(A) Employ technology to capture digital 

22 images of identity source documents so that the im- 

23 ages can be retained in electronic storage in a 

24 transferrable format for at least as long as the appli- 
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12 

1 cable driver’s license or identification card is valid; 

2 or 

3 “(B) retain paper copies of source documents 

4 for at least as long as the applicable driver’s license 

5 or identification card is valid. 

6 “(2) Subject each person who submits an appli- 

7 cation for a driver’s license or identification card to 

8 mandatory facial image capture. 

9 “(3) Establish an effective procedure to confirm 

10 or verify a renevdng applicant’s information. 

11 “(4) Confirm with the Social Security Adminis- 

12 tration a social security account number presented 

13 by a person using the full social security account 

14 number. In the event that a social security account 

15 number is already registered to or associated with 

16 another person to which any State has issued a driv- 

17 er’s license or identification card, the State may use 

18 any appropriate procedures to resolve nonmatches. 

19 “(5) Establish an effective procedure to confirm 

20 that a person submitting an application for a driv- 

21 er’s license or identification card is terminating or 

22 has terminated any driver’s license or identification 

23 card issued pursuant to this section to such person 

24 by a State, 
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13 

1 “(6) Pro%4de for the physical security of loca- 

2 tions where driver’s licenses and identification cards 

3 are produced and the security of document materials 

4 and papers from w'hieh driver’s licenses and identi- 

5 fieation cards are produced. 

6 “(7) Establish appropriate administrative and 

7 physical safeguai’ds to protect the secuiity, confiden- 

8 tiality, and integrity of personally identifiable infor- 

9 mation collected and maintained at locations at 

10 which driver’s licenses or identification documents 

1 1 are produced or stored, including — 

12 “(A) procedures to prevent the unauthor- 

13 ized access to, or use of, personally identifiable 

14 information; 

15 “(B) public notice of security and privacy 

16 policies, including the use, storage, access to, 

17 and sharing of personally identifiable informa- 

1 8 tion; 

19 “(C) the establishment of a process 

20 through which individuals may access, amend, 

21 and correct, as determined appropriate by the 

22 State, their owm personally identifiable informa- 

23 tion. 
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1 “(8) Subject all persons authorized to manufac- 

2 ture or produce driver’s licenses and identification 

3 cards to appropriate security clearance requirements. 

4 “(9) Establish fraudulent document recognition 

5 and document validation training programs for ap- 

6 propriate employees engaged in the issuance of driv- 

7 er’s licenses and identification cards. 

8 “(10) Limit the period of validity of all driver’s 

9 licenses and identification cards that are not tem- 

10 porarj' to a period that does not exceed 8 years, 

1 1 “(e) Exceptions Process. — 

12 “(1) In general. — S tates shall establish an 

13 exceptions process to reasonably accommodate per- 

14 sons who, foi' extraordinary reasons beyond their 

15 control, are unable to present the necessarj^ doeu- 

16 ments listed in subsection (e)(1). 

17 “(2) ALTERNATn^ DOCUMENTS. — ^Alternative 

18 documents accepted under an exceptions process es- 

19 tablished pursuant to paragraph (1) may not be 

20 used to demonstrate lawful presence under sub- 

21 section (c)(2) unless such documents establish that 

22 the person is a citizen or national of the United 

23 States. 

24 “(3) Report. — S tates shall include a report on 

25 the use of exceptions made under this subsection, 
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1 which shall not include any personally identifiable 

2 information, as a component of the certification re- 

3 quired under subsection (a)(3). 

4 “(f) Use of FEDERi\ij Systems.— States shall not 

5 be required to pay fees or other costs associated with the 

6 use of the automated sj''stems known as Systematic Alien 

7 Verification for Entitlements and Social Security On-Line 

8 Verification, or any other Federal electronic system, in 

9 connection with the issuance of driver’s licenses or identi- 

10 fication cards, in accordance with this subtitle. 

11 “(g) Rule op Construction. — Notlhng in this sec- 

12 tion shall be construed to prohibit a State from issuing 

13 driver’s licenses and identification cards that do not com- 

14 ply with the requirements of this section. 

15 “SEC. 243. USE OF FALSE DRIVER’S LICENSE AT AIRPORTS. 

16 “(a) In GeneraIj. — The Secretary shall enter, into 

17 the appropriate aGation security screening database, ap- 

18 propriate information regai-ding any person convicted of 

19 using a false driver’s license at an airport. 

20 “(b) Definitions. — In this section: 

21 “(1) Airport. — The term ‘airport’ has the 

22 meaning given such term under* section 40102 of 

23 title 49, United States Code. 


•S 1281 IS 


VerDate Nov 24 2008 


09:40 Jun 06, 2011 Jkt 51792 PO 00000 Frm 000073 Fmt 06601 Sfmt 06601 


P:\DOCS\51792.TXT SAFFAIRS 


PsN: PAT 



70 


16 

1 “(2) FaIjSE. — T he term ‘false’ has the meaning 

2 given snch term under section 1028(d) of title 18, 

3 United States Code. 

4 “SEC. 244. GRANTS TO STATES. 

5 “(a) ESTABiaSHMBNT. — 

6 “(1) In GENEiGiTi. — There is established a 

7 State Driver’s License Enhancement Grant Program 

8 to award grants to assist States in conforming to 

9 the minimum standards set forth in this .subtitle. 

10 “(2) Distribution of gr.\nts. — The Sec- 

11 retaiy, through the Administrator of the Federal 

. 12 Emergency Management Agency, shall distribute 

13 grants awarded under this section to States that 

14 submit an application as follows: 

15 “(A) Proportional allocation. — Not 

16 less than % of the amounts appropriated for 

17 grants under this section shall be allocated to 

18 each State in the ratio that — 

19 “(i) the number of driver’s licenses 

20 and identification cards is.sued by such 

21 State in the most recently ended calendar 

22 .year; bears to 

23 “(ii) the number of driver’s licenses 

24 and identifications cards issued by all 
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17 

States in the most recently ended calendar 
year. 

“(B) Remaining allocation, — The Sec- 
retary may allocate to States any amounts ap- 
propriated for grants under this section that 
are not allocated under subparagraph (A) in 
such manner as, in the Secretaire’s discretion, 
will most effectively assist in achieving the goals 
of this subtitle. 

“(C) Minimum allocation. — In allo- 
cating funds under this section, the Secretary 
shall ensure that for each fiscal year — 

“(i) except as provided under clause 
(ii), each State receives not less than an 
amount equal to 0.35 percent of the total 
funds appropriated for grants under this 
section for that fiscal year; and 

“(ii) American Samoa, the Common- 
wealth of the Northern Mariana Islands, 
Guam, and the Virgin Islands each receive 
not less than an amount equal to 0.08 per- 
cent of the total funds appropriated for 
gi'ants under this section for that fiscal 
,yea.r. 
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1 “(b) Authoeization of Aivkopeiations. — There 

2 are authorized to be appropriated to the Secretary, for 

3 each of the fisea) years 2010 through 2015, such sums 

4 as may be necessary to carrj^ out this section. 

5 “SEC. 245. STATE-TO-STATE ONE DRIVER, ONE LICENSE 

6 DEMONSTRATION PROJECT. 

7 “(a) Establishment. — The Secretar}'-, in eonsulta- 

8 tion with the Secretary of Transportation, shall establish 

9 a State-to- State 1 driver, 1 license demonstration project. 

10 “(b) Purpose. — The demonstration project estab- 

1 1 lished under this section shall include an evaluation of the 

12 feasibility of establishing an electronic system to verify 

13 that an applicant for a driver’s license or identification 

14 card issued in accoi’dance with this subtitle does not r-etain 

15 a driver’s license or identification card issued in accord- 

16 anee uith this subtitle by another State. 

17 “(c) Requirements. — The demonstration project 

1 8 shall include a reriew of — 

19 “(1) the costs affiliated irith establishing and 

20 maintaining an electronic recoi’ds system; 

21 “(2) the security and privacy measui’es nec- 

22 essary to protect the integrity and physical security 

23 of driver’s licenses; and 

24 “(3) the appropriate governance structure to 

25 ensure effective management of the electronic 
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1 records system, including preventing the unauthor- 

2 ized use of information in the system, and ensuring 

3 the security and confidentiality of personally identifi- 

4 able information. 

5 “(d) Savincjs Provision. — Nothing in this section 

6 may be construed to — 

7 “(1) authorize the creation of a national data- 

8 base of driver’s license information; or 

9 “(2) authorize States direct access to the motor 

10 vehicle database of another State. 

11 “(e) Atttiiorization of Appropriations. — There 

12 are authorized to be appropriated to the Secretary for 

13 each of the fiscal years 2010 through 2012 such sums as 

14 may be necessary to cany out this section. 

15 “SEC. 246. AUTHORITY. 

16 “(a) Participation of Secretary of Tr.\nspor- 

17 tation .:\nd States. — ^All authority to issue regulations, 

18 set standards, and i.ssue grants under this subtitle shall 

19 be carried out by the Secretary, in consultation with the 

20 SecretaiA' of Tran.sportation and the States. 

21 “(b) Extensions op Deadlines. — The Secretary 

22 may grant to a State an extension of time to meet the 

23 requirements of section 242(a)(1) if the State provides 

24 adequate justification for noncompliance. 
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1 “SEC. 247. LIMITATION ON STATUTORY CONSTRUCTION. 

2 “Nothing in this subtitle may be constraed to — 

3 “(1) affect the authorities or responsibilities of 

4 the Secretary of Transportation or the States under 

5 chapter 303 of title 49, United States Code; or 

6 “(2) preempt State privacy laws that are more 

7 protective of personal privacy than the requirements 

8 of this subtitle or the standards or regulations pro- 

9 mulgated to implement this subtitle, provided that 

10 such State laws are consistent with this subtitle and 

11 the regulations prescribed pui’suant to this sub- 

12 title.”. 

13 (b) TeohnicaI; Amendment, — S ection 1(b) of the 

14 Homeland Security Act of 2002 (Public Law 107-296) 

15 is amended by inserting after the item relating to section 

16 235 the following; 

“Subtitle E — Inijiroved Smirity for Drivers Licenses and Persona! 
Identification Cards 

“See. 241. Definitions. 

“Sec. 242. Miiiimiim doeiunent requirements and issnanco .standards for Fed- 
eral recognition. 

“See. 243. Use of false dnver's license at aiiToorts. 

“Sec. 244. Grants to States. 

“Sec. 245. State-to-Slate one driver, one license demonstration projoct. 

“Sec. 246. Authority. 

“Sec, 247. Limitation on statntorj'^ construction.”. 

17 SEC. 4. USE OF DRIVER’S LICENSE OR IDENTIFICATION 

1 8 CARD DATA BY PRIVATE ENTITIES. 

19 Chapter 123 of title 18, United States Code is 

20 amended — 
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1 (1) in section 2722, by adding at the end the 

2 following: 

3 “(c) Copying Information From Drivers Li- 

4 CENSES OR Identification Cards. — I t shall be unlawdiil 

5 for any person, knowingly and without la\¥ful authority — - 

6 “(1) to scan the information contained in the 

7 machine readable component of a driver’s license or 

8 identification card; or 

9 “(2)(A) to resell, share or trade that informa- 

10 tion with any other third parties; 

11 “(B) track the use of a driver’s license or iden- 

12 tification card; or 

13 “(C) store the information collected.”; 

14 (2) in section 2724(a), by inserting “driver’s li- 

15 cense, or identification card,” after “motor vehicle 

16 record,”; 

17 (3) in section 2725- — 

18 (A) by redesignating paragi'aph (2) as 

19 paragraph (6), and adding “and” at the end; 

20 (B) by redesignating paragraph (3) as 

21 paragraph (7); 

22 (C) by redesignating paragraph (4) as 

23 paragraph (3), and striking “and” at the end; 
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1 (D) by redesignating paragi’apli (5) as 

2 paragraph (2), and striking the period at the 

3 end and inserting a semicolon; 

4 (E) by redesignating paragraph (1) as 

5 paragraph (5); 

6 (P) by inserting before paragraph (2), as 

7 redesignated, the followang: 

8 “(1) ‘driver’s license’ means a motor vehicle op- 

9 erator’s license, as defined in section 30301 of title 

10 49, United States Code;”; and 

11 (G) by inserting after paragraph (3), as re- 

12 designated, the followang: 

13 “(4) ‘identification card’ means a personal iden- 

14 tifieation card, as defined in section 1028(d) of title 

15 18, United States Code, issued by a State.”. 

16 SEC. 5. RULEMAKING. 

17 (a) In GeneilUj. — N ot later than 9 months after the 

18 date of the enactment of this x\ct, the Seeretaiy, after pro- 

19 ^^ding notice and an opportunity for public comment shall 

20 issue final regulations to implement subtitle E of title 11 

21 of the Homeland Security Act of 2002, as added by section 

22 3. 

23 (b) Content. — The regulations issued pursuant to 

24 subsection (a) — 
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1 (1) shall include procedures and requirements 

2 that — 

3 (A) protect the privacy rights of individ- 

4 uals who apply for and hold a driver’s license 

5 or personal identification card; 

6 (B) protect the constitutional rights and 

7 civil liberties of indhiduals who apply for and 

8 hold a driver’s licenses or personal identification 

9 card; 

10 (2) shall include procedures to protect any per- 
il sonally identifiable information electronically trans- 

12 mitted; 

13 (3) shall establish a process through which indi- 

14 viduals may access, amend, and correct, as deter- 

15 mined appropriate by the Secretary, their owm per- 

16 sonally identifiable information in any Federal data- 

17 bases used in eompl.ying with this Act; 

18 (4) may not require a single design or num- 

19 bering system to which driver’s licenses or personal 

20 identification cards issued by all States shall con- 

21 form; and 

22 (5) shall only apply to driver’s licenses or iden- 

23 tification cards issued pursuant to subtitle E of title 

24 II of the Homeland Security Act of 2002, as added 

25 by section 3. 
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1 SEC. 6. SAVINGS PROVISION. 

2 (a) Effect of RepeaIj.— Nothing in section 2 shall 

3 affect the amendment or the repeal set forth in sections 

4 203(a) and 206 of the REAIj ID Act of 2005. 

5 (b) Effect op Completed Administrative Ac- 

6 TIONS.— Completed personnel actions, agreements, grants, 

7 and contracts undertaken by an agency — 

8 (1) shall not be affected by any pro\ision of this 

9 Act, or any amendment made by this Act; and 

10 (2) shall continue in effect according to their 

1 1 terms until amended, modified, superseded, termi- 

12 nated, set aside, or revoked by an officer of the 

13 United States, by a court of competent jurisdiction, 

14 or by operation of law. 

o 


•S 1261 IS 


VerDate Nov 24 2008 09:40 Jun 06, 201 1 Jkt 51792 PO 00000 Frm 000082 Fmt 06601 Sfmt 06601 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



79 


Opening Statement 

OF 

Senator George V, Voinovich 

Committee on Homeland Security and Governmental Affairs 
“Identification Security: Reevaluating the REAL ID Act” 

Wednesday, July 15, 2009 

Mr, Chairman, thank you for convening today’s hearing about such an important issue. 

I also want to thank the champion of the PASS ID Act, Senator Akaka, for his work on 
this issue. Senator Akaka has been working to address concerns with the REAL ID Act since 
2006, and I am proud to cosponsor this bill that addresses those concerns while still fulfilling the 
9/1 1 Commission recommendation that the federal government set standards for the issuance of 
driver’s licenses and identification cards. 

I have joined Senator Akaka’s efforts primarily for three reasons. First, I have often 
expressed concerns with the cost the REAL ID Act imposes on states. 

The Department of Homeland Security, or DHS, estimates the REAL ID Act will cost 
states almost $4 billion, and the NGA estimates it will cost states $1 1 billion. As a former 
Mayor and Governor, I have first-hand experience with the impact such costs can have on the 
ability of state and local governments to provide critical services to their citizens, especially 
given current budgetary constraints, and I look forward to hearing from Governor Douglas and 
the NGA today about this matter. 

I was also very unhappy with the process that led to the REAL ID Act’s enactment as 
part of the FY2005 Emergency Supplemental Appropriations conference report without 
opportunity for Senate debate or amendment, and without state input. 

The concern and consternation that has resulted from the REAL ID Act, including at least 
thirteen states enacting legislation opposing the law, is a classic example of the problems that 
occur when regular order is short circuited and there is no opportunity for robust debate. 

Lastly, I have expressed concerns about the fact that the REAL ID Act calls for states to 
use databases that are not fully operational. 

For example, the REAL ID Act envisions states using the Electronic Verification of Vital 
Events database to verify each driver’s license applicant’s birth certificate. But that database is 
not fully connected to allow verification of birth certificates from many jurisdictions. 
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The Providing for Additional Security in States Identification, or PASS ID, Act of 2009 
addresses these and other concerns while still setting uniform standards for the issuance of 
driver’s licenses and identification cards. In other words, the PASS ID Act addresses many of 
the problematic provisions of the REAL ID Act while still ensuring that a key 9/1 1 Commission 
recommendation is carried out. 

Just like the REAL ID Act, the PASS ID Act would require that driver’s licenses include 
certain information about the card holder and security features to be accepted for federal 
purposes. 

The PASS ID Act would require verification of an applicant’s legal status in the United 
States using the Systematic Alien Verification for Entitlements database, just like the REAL ID 
Act does. 

As with the REAL ID Act, the PASS ID Act requires confirmation of an applicant’s 
social security number using the Social Security On-Line Verification database. 

It is also important to note what the PASS ID Act does not do. 

The PASS ID Act does not allow states to rubber-stamp applicants’ source documents. 
Instead, PASS ID allows states to validate information in instances when databases are not fully 
operational or connected. 

The PASS ID Act does not give states money without accountability or fiscal 
responsibility. In reality, there is little difference between the REAL ID grant program and the 
PASS ID grant program. 

The PASS ID Act does not weaken airport security by allowing anyone to board a 
commercial aircraft; rather, the bill provides that “no person shall be denied boarding a 
commercial aircraft solely on the basis of failure to present a” PASS ID. The prior 
Administration acknowledged that under the REAL ID Act this would indeed be the case by 
stating in the REAL ID Final Rule that “travelers will be able to use identification other than a 
REAL ID driver's license to board an aircraft.” 

Additionally, the Transportation Security Administration has procedures in place for 
passengers who do not or cannot present a secure form of identification. Among other things, 
such individuals may be subject to additional screening. 

Lastly, the PASS ID Act does not end DHS’ practice of allowing grants to be given to 
states to create an information-sharing system to ensure that applicants no longer hold driver’s 
licenses from other states. 

Rather, the bill codifies a practice DHS began in fiscal year 2008 to fund a multistate 
project to improve state and inter-state data verification capabilities. 

1 want to thank our witnesses for appearing here today to discuss the PASS ID Act. I 
have often said that we must implement the 9/1 1 Conunission recommendations in a way that is 
intelligent, thoughtful, and involves good management practices. I believe that the PASS ID Act 
does just that. 

Thank you, Mr. Chairman. 
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Prepared Statement of Senator Roland W. Burris 
July 15, 2009 

Thank you Chairman Lieberman and Ranking Member Collins. I’m pleased to be 
here today to discuss an issue of national importance: the security of our driver’s 
licenses and identification cards. 

We are finding now more than ever that setting effective yet reasonable national 
standards for driver’s licenses and identification cards is vital to our domestic 
security. Everyday documents like a driver’s license, a social security card, and 
even household mail can be used by criminals to obtain fraudulent identification 
documents. 

It is our responsibility in Congress to combat this problem and enact laws that 
States can comply with. For a secure identification card system to be possible, we 
need cooperation from all jurisdictions. Right now this is not happening. 

I come from a state that has voiced its concerns by passing a joint resolution in 
opposition to the REAL ID Act. Its funding, actual implementation status, and the 
burdensome requirements it places on states are all issues of contention I feel we 
can strengthen. One way to do this is to consider the advantage the PASS ID Act 
gives our states in developing and improving identification and information 
sharing systems. 

In talking with constituents and individuals at the state level, it is evident that while 
there will always be privacy and security concerns, the benefits of having a 
tolerable secure licensing system in place far outweighs continuing with a system 
many do not feel comfortable with. 

I look forward to the panelists testimony today and I am open to any 
recommendations they might have as to how we can strengthen our identity 
security laws. 
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Chairman Lieberman, Senator Collins, and members of the Committee: Thank 
you for your leadership on homeland security issues, and thank you for holding this 
important hearing today on how the passage of the Providing Additional Security in 
States’ Identification Act of 2009, also called PASS ID, will enhance our Nation’s 
security. The Department of Homeland Security (DHS) provided technical assistance to 
PASS ID’s Senate sponsors in drafting this bill, and we look forward to continue working 
with Congress on the bill as it moves through the legislative process. 1 urge this 
Committee to mark up PASS ID promptly so it can be considered by both houses of 
Congress and signed into law this calendar year. 

PASS ID is a critical piece of national security legislation that will fix the REAL 
ID Act of 2005 and institute strong security standards for government-issued 
identification. PASS ID will fulfill a key recommendation of the 9/1 1 Commission, that 
the federal government set standards for identification such as driver’s licenses and non- 
driver identification cards - and this bill will do so in a way that states will implement, 
rather than disregard. PASS ID will enact the same strong security standards set out by 
REAL ID as quickly as REAL ID - but, critically, this bill provides a workable way to 
get there. 

We must work to keep terrorists and other criminals from obtaining false 
identification - and in order to do that, we need to have consistent, strong standards for 
identification documents that all states can implement. The 9/1 1 Commission was clear 
about this. But the REAL ID Act is unlikely to be implemented by the states as Congress 
intended, and a new approach is needed if we are to accomplish the law’s goals. 

As a former Governor and former chair of the National Governors Association, I 
can attest that the states strongly support the goals of the REAL ID Act, but many feel 
that they didn’t have an adequate opportunity to help shape the law, and find it 
fundamentally flawed. Indeed, 12 states have so far passed legislation outright rejecting 
it, two states have passed legislation refusing to implement it without significant 
conditions being met, 1 1 states have passed resolutions opposing it, and many other states 
are refusing to implement it.’ PASS ID was built with the states, maintaining strong 
security standards and introducing enough changes in implementing those same standards 
as to provide states a system in which they will participate. This, unlike the status quo, 
will yield the progress we need on secure identification. 

PASS ID’S Senate sponsors - Senators Akaka, Voinovich, Baucus, Carper, Leahy 
and Tester - along with the Department of Homeland Security and the National 
Governors Association (NGA), collaborated with state and local governments and law 
enforcement to draft a bill to fix REAL ID and institute strong standards for secure 
identification. PASS ID enjoys the support of Democrats and Republicans in Congress, 
Governors and state legislators throughout the country, and state, local and federal law 
enforcement groups. Governor Jim Douglas of Vermont, the incoming Chair of the NGA, 


' Those states with laws prohibiting compliance with REAL ID are Alaska, Arizona, Idaho, Louisiana, 
Maine, Minnesota, Montana, New Hampshire, Oklahoma, Oregon, South Carolina, and Washington. 
Georgia and Virginia have more conditional laws prohibiting themselves from complying with REAL ID. 
Missouri’s legislature has passed a bill prohibiting REAL ID implementation that is before the governor at 
the time of this testimony’s submission. Arkansas. Colorado, Hawaii, Illinois, Missouri, Nebraska, Nevada, 
North Dakota, and South Dakota have passed concurrent or joint legislative resolutions in opposition to 
REAL ID. Pennsylvania’s two legislative chambers have passed separate resolutions opposing it. The 
Michigan House has also passed a resolution against REAL ID. 


Page 2 of 9 


I 


VerDate Nov 24 2008 


09:40 Jun 06, 2011 


Jkt 51792 PO 00000 


Frm 000087 Fmt 06601 Stmt 06601 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



84 


and Sheriff Lee Baca from Los Angeles County are here to discuss the reasons why 
PASS ID has won support from the states and the law enforcement community. 

The need for Congress to fix REAL ID is urgent. If Congress fails to enact new 
legislation, we will continue to have a law on the books that does not meet the security 
needs of our Nation. We cannot leave an important recommendation of the 9/1 1 
Commission unfulfilled. 

There is another urgent reason for acting quickly. As it currently stands, the next 
stage of REAL ID implementation - scheduled for the end of 2009 - would result in 
major complications for the residents of 1 2 states with anti-REAL ID laws, as well as for 
residents of other states that could refuse to implement REAL ID. The more than 40 
million people living in those 12 states would be unable to use their driver’s licenses for 
official purposes such as boarding an airplane, even though no state will have issued a 
REAL ID-compliant document by that time. 

In order to solve the problems of REAL ID, it is imperative that this Committee, 
and Congress as a whole, heed the call of Governors and law enforcement to enact the 
PASS ID Act promptly. 

Why We Need Secure Identification 

The ability to obtain fraudulent identification documents presents an opportunity 
for terrorists and other violent criminals to board airplanes, rent cars, open bank accounts, 
or conduct other activities without being detected. Law enforcement must be able to rely 
on government-issued identification documents. An officer must be able to know that the 
bearer of a government-issued ID is who he or she claims to be, and must have the ability 
to identify a fraudulent ID quickly. 

We need nationwide standards because states vary widely in how they issue 
driver’s licenses and non-driver’s license identification cards produced by states’ motor 
vehicle departments, the two types of identification to which both REAL ID and PASS 
ID apply. (For shorthand, when I refer to “driver’s licenses’’ in this testimony, I mean 
both of those types of identification.) Nationwide security standards for IDs would give 
law enforcement officials the assurance that all IDs meet a high threshold of security. 
While fraudulent IDs play a major role in identity theft, illegal employment, and border 
crime, the most immediate reason we need to secure government-issued IDs is to thwart 
potential terrorists. 

As you know, the ability of terrorists to obtain government-issued IDs played a 
significant role in the events leading to the attacks of September 1 1, 2001 . According to 
the 9/1 1 Commission Report, “All but one of the 9/1 1 hijackers acquired some form of 
U.S. identification document, some by fraud.”^ Preventing terrorists from obtaining these 
documents is critical to securing America against terrorism. As the 9/11 Commission 
noted, “For terrorists, travel documents are as important as weapons.’’^ 

The 9/1 1 Commission recommended that the federal government work with other 
layers of government to solidify the security of government-issued IDs: 

Secure identification should begin in the United States. The federal government should 

set standards for the issuance of birth certificates and sources of identification, such as 


■ 9/1 1 Commission Report, p. 390 
^ 9/ 11 Commission Report, p, 384. 
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drivers licenses. Fraud in identification documents is no longer just a problem of theft. At 
many entry points to vulnerable facilities, including gates for boarding aircraft, sources of 
identification are the last opportunity to ensure that people are who they say they are and 
to check whether they are terrorists.'* 

Improving government-issued IDs alone will not thwart every planned terrorist attack, 
but it presents an important obstacle to any potential terrorist operating in the United 
States and could aid law enforcement in stopping terrorist plots. Securing IDs is a 
common-sense national security imperative. The 9/1 1 Commission spelled out the need 
for the federal government and the states to take action together on this issue - a process 
that has been unduly hampered by the REAL ID Act. 

Problems with the REAL ID Act 

From the perspective of DHS, the major problem with REAL ID is that it is 
producing very little progress in terms of securing driver’s licenses, and it is not getting 
us to where we need to be. Simply put, REAL ID is unrealistic. It presents major 
concerns to the states on a number of fronts, and when 12 states have so far outlawed 
themselves implementing REAL ID, there will never be effective national standards for 
identification until REAL ID is fixed. 

Inflexible electronic verification requirements 

A necessary part of increasing ID security is setting strong standards that states 
would need to meet in verifying the underlying documents a person presents when 
applying for a driver’s license (for example, a birth certificate or driver’s license from 
another state). REAL ID would require states to adopt new technologies in order to verify 
all those “identity source” documents electronically, including documents issued by other 
states. 

This mandate is too rigid. Many of the required databases are simply not ready - 
and this requirement provides states little leeway to try to adopt more efficient and 
effective methods for data verification. Under REAL ID, the states would need to spend 
an estimated $1.5 billion to electronically verify applicants’ information and to upgrade 
their systems. States have bristled at being required to absorb this expense when they 
could take equally effective measures at less cost. 

Inflexible re-enrollment system 

Similarly, the process by which current driver’s license holders renew their 
driver’s licenses, presenting their source documents to enroll secure ID, is a critical part 
of any ID security initiative. But REAL ID issues inflexible mandates to the states on this 
score. 

Current regulations impose a specific schedule for the states to re-enroll their 245 
million driver’s license holders. Under REAL ID, re-enrollment would need to be 
completed in a six-year window, from May 1 1, 201 1 until December 1, 201 7. The rule 
then requires that those under the age of 50 - about 60 percent of all license holders - re- 
enroll in the first three years of that window, by December 1, 2014.^ 


■' 9/1 / Commission Report, p. 390. 

’ Neither REAL ID nor PASS ID would require an individual to re-enroll if he or she does not want a 
compliant driver’s license or non-driver’s license ID, but that person would not be able to use a non- 
compliant driver’s license or other non-compliant ID for official purposes. 
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So long as the Nation reaches the same goal, states should be allowed to find the 
most efficient and effective ways of expeditiously bringing their residents into a secure 
ID program based on their own renewal cycles and operations, rather than being forced to 
follow a rigid age-based plan. PASS ID, if enacted this year, would have states complete 
issuance by 2016, one year earlier than the current REAL ID schedule, but states retain 
the authority to meet that deadline as they see fit. 

Higher costs than necessary 

REAL ID would require an estimated $3.96 billion for states to implement, yet 
minimal funds have been appropriated to the states for this purpose. When REAL ID 
passed in 2005, the states balked at accepting a mandate they had played no part in 
creating. Today, this hefty burden is made even more onerous by the economic 
conditions that are constricting state budgets. 

Enhancing ID security by setting nationwide standards will be more expensive 
than the current system - there’s no question about it. But in specifically requiring how 
states meet security standards, rather than having states meet standards in the ways they 
deem most effective and efficient, REAL ID makes strong security standards more costly 
than they need to be. Mandating electronic verification or a specific re-enrollment 
schedule are examples of this. 

No incentive to innovate 

As is clear, the rigid mandates in the REAL ID Act provide states with little 
leeway to devise new or better systems to achieve the same security standards. Ideally, 
states would not merely meet security standards, but also exceed them, and accomplish 
this in new and better ways. States are laboratories for innovation in government and are 
best positioned to implement policies according to their operational considerations. 
Provided the states are on the path to meeting the same strong ID security standards, the 
federal government should allow flexibility in the means they choose to get there. 

Inadequate privacy protections 

Several provisions of REAL ID have raised substantial privacy concerns among 
citizens and state lawmakers. Specifically, REAL ID calls for states to provide electronic 
access to information contained in their motor vehicle databases to all other states. It is 
completely unclear how the law envisions this access to be used, much less monitored 
and managed to ensure privacy protections. Uncertainty about this provision has led to 
assumptions that REAL ID allows officials of any state to view an applicant’s personally 
identifiable information as part of a national system. 

REAL ID lacks sufficient rules regarding who could access, share, or even sell 
personal information contained in the machine-readable barcode on a REAL ID- 
compliant document. The current law also lacks protections or procedures for individuals 
who want to change their data or correct erroneous data in records databases. 

Costs of inaction 

It is essential for Congress to act promptly to address concerns raised by REAL 
ID because not changing the law could result in major complications, especially for the 
residents of the 12 states with anti-REAL ID laws on the books. Due to the concerns 
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raised by states during the REAL ID rulemaking process, the Department has allowed for 
various extensions related to compliance. On March 1, 2007, the Department announced 
it would grant extensions to all states requesting extensions, not to exceed December 31, 
2009. The Department has also announced that a second extension is available, but only 
to those states that have met certain benchmarks by December 31. These benchmarks 
include a certification by the state that it will comply with REAL ID. 

Clearly, this is very problematic for states with anti-REAL ID laws and 
resolutions. In the 12 states with laws against REAL ID, the December 31 deadline 
means that residents of these states - who number more than 40 million - will not be able 
to use their driver’s licenses for official purposes, such as boarding aircraft. The residents 
of Georgia and Virginia may also be affected by their states' less-conclusive anti-REAL 
ID laws. Eleven other states have passed legislative resolutions opposing REAL ID and 
could be affected. Together, all these states have 1 1 1 million residents, including more 
than 84 million adults, who could be affected by this deadline. 

All in all, half the states have taken some kind of legislative stand against REAL 
ID and more have expressed serious reservations. Due to the significant budget problems 
facing all states, it is highly likely other states will also refuse to implement REAL ID. 
And, under REAL ID, residents of states that have indicated they will comply will be 
allowed to use their driver’s licenses for boarding aircraft and other official purposes, 
despite the fact that their licenses may be no more secure than those issued by states that 
have refused to comply. This is because no state - including those without anti-REAL ID 
laws - will issue REAL IDs by the end of the year. Which driver’s licenses are accepted 
and which are not would be based on a promise of future action, rather than on actual 
security differences between those driver’s licenses. Such a situation would not advance 
our security, and underscores the need of Congress to act quickly. 

The bottom line is that because of the states’ objections to REAL ID, today - four 
years since its passage, five years after the 9/1 1 Commission Report, and nearly eight 
years after 9/1 1 - the United States has not realized secure identification. There has got to 
be a better way - and that is why I support the approach in PASS ID. 

PASS n): A Workable Model for Security Standards 

The PASS ID Act establishes the ID security standards the Nation needs while 
fixing the problems of the REAL ID Act. A few individuals have responded to criticism 
of REAL ID by suggesting that any change in the law would weaken the standards it 
established. Such a criticism is Just wrong. Strong security standards for driver’s licenses 
remain the same in the two laws . The two laws are different only in that PASS ID is more 
nimble and provides a feasible way to achieve ID security. The changes PASS ID makes 
in directing how security standards are to be implemented are enough to bring the states 
on board and leave behind a status quo where the Nation has not made sufficient progress 
on secure identification. 

Key similarities in PASS ID: Strong security standards called for by the 9/1 1 Commission 

PASS ID will implement the recommendation of the 9/1 1 Commission that the 
federal government provide standards for the issuance of secure identification documents. 
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PASS ID would provide standards in fulfilling that recommendation that are just as 
strong as those in REAL ID. 

• Document verification - PASS ID would maintain strong standards for ensuring 
the authenticity of identity source documents applicants show to obtain a driver’s 
license. States would be required to have sufficient processes in place to 
determine the authenticity of documents, including birth certificates or IDs issued 
by other states. PASS ID would require electronic verification through two federal 
databases that are used today - SSOLV for social security numbers and SAVE for 
immigration status. 

• Physical security of ID production — PASS ID would require states to ensure the 
physical security of the means of driver’s license production, and to conduct 
background checks on employees who deal with driver’s license issuance, in 
order to reduce the chance of malfeasance and fraud. PASS ID would also require 
all such employees to be trained in fraudulent document detection. These 
standards remain unchanged from REAL ID. 

• Photographs of ID applicants - PASS ID would necessitate that states capture 
photographs of individuals who apply for a PASS ID-compliant driver’s license, 
including those who are denied, clarifying a provision of REAL ID that states had 
said was unclear. 

• Requirements to show PASS IDs - As under REAL ID, non-secure driver’s 
licenses would no longer be accepted at the end of the PASS ID implementation 
period in order to enter nuclear power plants; federal facilities dealing with 
national security, homeland security, or defense; and to board airplanes.^ PASS 
ID would not extend to federal locations where REAL ID could potentially have 
been applied but are openly accessible to the public, such as national parks. 

All in all, PASS ID would match the security provided in REAL ID, while 
providing the states with more flexibility to innovate and meet the standards. 

Key differences in PASS ID: Fixes problems in implementation, cost, and privacy 

In addition to providing for security standards matching those of REAL ID, PASS 
ID provides a framework that is more workable from the state perspective. 

• Document verification - PASS ID would require states to have adequate means of 
validating the underlying documents of a state-issued driver's license. But unlike 
REAL ID, PASS ID would provide options to the states to make these 
determinations. While REAL ID mandates electronic verification for all source 
document information, PASS ID would maintain a focus on ensuring the 
authenticity of identity source documents that applicants present, allowing states 
to adopt cost-effective ways to achieve or exceed that threshold. This provision 
eliminates the need for every state to adopt expensive and unnecessary 


‘ Under PASS ID - the same as under REAL ID - a traveler who does not have a qualiiying government- 
issued ID will be subject to greater scrutiny as Transportation Security Officers (TSO) determine his or her 
identity and confirm that the passenger is not on the Terrorist Screening Center's watchlist. TSOs deal 
every day with travelers who have lost their identification or been victims of theft while on a trip. TSOs 
make an appropriate decision based on an assessment of available identification that a passenger may carry, 
or information that the passenger can provide. 
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technologies. DHS will continue to work with interested states in developing 
voluntary electronic verification capabilities, through a demonstration project that 
will help determine whether state-to-state electronic verification can become 
accurate and workable, and do so with the necessary privacy and security 
protections built in. Again, the flexibility of PASS ID allows us to proceed with 
national standards. 

• Lower potential costs - Greater flexibility in several areas would substantially 
lower the potential cost to the states for implementing the program. These 
changes produce cost estimates for PASS ID significantly less than those for 
REAL ID, though the exact cost would depend on the particular systems states 
decide to adopt. The bill would also codify the current Driver’s License Security 
Grant Program and specify that the funding is meant for PASS ID compliance, 
with $50 million requested in the FY 2010 President’s Budget Request. 

• Faster implementation and flexibility ASS ID could take effect faster than the 
current REAL ID schedule. States would have one year after the issuance of final 
DHS regulations to begin issuing compliant documents, and would have five 
years from that date to enroll driver’s license holders as they see fit. The REAL 
ID deadline for completing issuance of compliant driver’s licenses is December 
2017. If Congress enacts the PASS ID Act as it is currently written by October 
2009, states could complete enrollment by July 2016, a full one year and five 
months ahead of the REAL ID timetable. This is part of why taking action on 
PASS ID is urgent. 

• Privacy protections - PASS ID would not require states to provide direct access 
to each other’s driver’s license databases; in fact, the bill contains protections 
against creating any national identity database containing all driver’s license 
information and requires states to adopt adequate procedures to prevent 
unauthorized access to or sharing of personally identifiable information. PASS ID 
would also require public notice of privacy policies enacted under the law. The 
bill would establish a redress process for individuals who believe their personal 
information should be amended in records systems. Moreover, it would restrict 
private entities from selling or trading the personal information contained in the 
barcode of a PASS ID-compliant driver’s license, and would prohibit private 
entities from scanning that portion unless it was specifically to support federal, 
state or local laws (such as purchasing a controlled substance or a weapon). 

1 want to emphasize that PASS ID accommodates any states that have already 
taken steps toward secure IDs under REAL ID. Despite the many problems of REAL ID, 
some states have made significant progress in the past four years on a number of fronts, 
including digitizing their records. PASS ID would not penalize these states and would 
allow states to keep either electronic or paper copies of their records. The states that have 
begun the process of digitization are already ahead of the game - digital records will 
certainly prove their worth in the long run. PASS ID is specifically designed not to 
penalize any states that made security advances under current law, but rather to allow 
states that have laws refusing to implement REAL ID to come back to the table. 

All in all, PASS ID is the fix for REAL ID that the Nation needs: one that keeps 
strong security standards that are critical to our safety, but provides workable ways to 
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achieve those standards. The states have embraced the changes included in PASS ID, 
which provides the Nation the opportunity to make real progress on ID security. 

Conclusion 

As the 9/1 1 Commission expressed clearly and specifically, the need to advance 
ID security across the Nation is urgent. Today, nearly five years after that Commission 
recommended that ID security reforms begin in the United States, we have made little 
progress. The REAL ID Act, though well-intentioned, has caused a stalemate on an issue 
where we cannot afford to wait any longer. 

If s time to break this impasse - and the approach taken under the PASS ID Act 
does just that. PASS ID improves upon REAL ID by maintaining high security standards 
while providing greater flexibility, reducing cost, accelerating implementation, protecting 
privacy, and promoting collaboration between the federal government and the states. 

This is why PASS ID has a bipartisan and geographically diverse group of 
sponsors, has won support from the bipartisan National Governors Association, and has 
received the endorsement of the National Sheriffs Association, the Federal Law 
Enforcement Officers Association, and the Major Cities Chiefs Association. With the 
right legislation, working in partnership with law enforcement and the states, we can and 
will make progress on this important security issue. 

Chairman Lieberman, Senator Collins, and members of the Committee: I urge you 
to join the Department of Homeland Security and our partners to support the approach 
taken under PASS ID. The time to act is now, given the deadlines involved, and we will 
continue working with you to address the specific language of the bill as it moves 
forward. Thank you for your continued partnership and for the opportunity to testify 
today. I can now answer any questions you have. 
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Chairman Lieberman, Ranking Member Collins and distinguished members of the committee, 
my name is Jim Douglas, Governor of the state of Vermont and Vice Chair of the National 
Governors Association (NGA). I appreciate the opportunity to appear before you today to 
discuss the issues surrounding state implementation of REAL ID and to lend my support for the 
solutions presented by S. 1261, the “Providing for Additional Security in States’ Identification 
Act of 2009” or PASS ID. 

OVERVIEW: 

As governor, I am committed to providing my citizens with a driver’s license that is accurate and 
secure. In fact, having repeatedly discussed REAL ID with my fellow governors over the past 
several years, I can assure you that all governors share common principles regarding licenses and 
state identification: 

• Licenses and identification cards should accurately reflect the identity of their owner; 

• The systems that produce the cards and the cards themselves must be secure; 

• Information received about individuals should be protected to ensure their privacy; and 

• Services and products should be provided in a cost-effective manner that maximizes 
value for taxpayers without diminishing the security or integrity of the license. 

It is through this lens that governors tend to view federal efforts to regulate state licenses such as 
REAL ID and PASS ID. In reviewing these measures. I’ve concluded that while the objectives 
of REAL ID are laudable, the law represents an unworkable and unfunded mandate that fails to 
make us more secure. In contrast, PASS ID builds on the strengths of REAL ID, resolves REAL 
ID’S weaknesses and delivers more cost-effective, common-sense solutions that can enhance the 
security and integrity of all driver licenses and state identification cards. 

BACKGROUND: 

Congress passed the REAL ID Act (REAL ID) as part of the Emergency Supplemental 
Appropriations for Defense, the Global War on Terror, and Tsunami Relief Act (P.L. 109-13). 
The law replaced section 7212 of the Intelligence Reform Act (P.L. 108-458), which established 
a negotiated rule making to determine national standards for state driver’s license and 
identification cards (DL/IDs). NGA supported the compromise contained in section 7212 
because it allowed stakeholders, including governors, to participate in the process of reforming 
what traditionally has been a state function. 

Although the negotiated rule making was already underway, REAL ID repealed the provision 
and replaced it with statutory standards, procedures and requirements that must be met if state- 
issued licenses and identification cards are to be accepted as valid identification by the federal 
government. REAL ID’s mandates require alteration of long-standing state laws, regulations and 
practices governing the qualifications for and the production and issuance of licenses in every 
state. Complying with REAL ID’s standards will require significant investments by states and 
the federal government and will test the resolve of citizens who will be directly affected by 
changes to state systems. 

More importantly, all of this must be done quickly. The next milestone for states is December 
3 1 of this year. As of that date, a state must be “materially compliant” with the act or individuals 
can no longer use its licenses or identification cards to board commercial aircraft. 
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Given its impact on states and individuals, governors worked closely with other state groups 
including the National Conference of State Legislatures and the American Association of Motor 
Vehicle Administrators to recommend a regulatory framework that could bridge the gap between 
state laws and practices and the unrealistic requirements of REAL ID. I commend the 
Department of Homeland Security (DHS) and members of this committee like Senator Collins 
for their efforts to develop a workable regulatory system to implement the law. 

Unfortunately, even after the final rule was released, major issues remained, including a lack of 
funding for state implementation; privacy concerns regarding the collection and use of 
individuals’ information; and uncertainty regarding the availability, development and cost of 
electronic databases. These concerns ultimately helped propel 12 states to pass laws prohibiting 
compliance with REAL ID and another 9 states to pass joint resolutions calling for its repeal. 

DEVELOPING A SOLUTION 

Given states’ ongoing concerns, and the looming deadline for material compliance, governors 
last year asked NGA to work with state experts to fashion a solution to REAL ID based on the 
following principles: 

1. Fulfill the 9/1 1 Commission recommendation for the “federal government to set 
standards for sources of identification”; 

2. Facilitate and encourage participation by all jurisdictions; 

3. Enhance the security and integrity of all license and ID cards while retaining state 
flexibility to innovate; and 

4. Address critical privacy concerns and reduce unnecessary costs. 

NGA’s work culminated in the following recommendations, which governors adopted in 
February; 

• Provide funds necessary for states to comply with federal requirements. The 
projected costs of complying with the act far outweigh existing sources of funding. To 
the extent federal requirements result in increased costs for states, the federal government 
should fiind the cost of complying with the law. 

• Allow for date-forward implementation. In order to comply with the act, states should 
only be required to issue compliant DL/lDs beginning on a certain date. All DL/lDs 
issued after that date would comply with the federal law, but individuals would not be 
required to obtain a new DL/ID until their existing DL/ID expires. This provision would 
not apply to non-federally compliant DL/IDs issued by a state. 

• Limit required electronic verification of documents. The final rule identifies five 
systems states will be required to use in order to be in compliance with the law: Social 
Security On-Line Verification (SSOLV); Electronic Verification of Vital Events Records 
(EWER); Systematic Alien Verification for Entitlements (SAVE); an all-drivers system 
run by the states to ensure an applicant is not licensed in another state; and a system run 
by the U.S, Department of State to validate foreign passport information. Of these 
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systems, only SSOLV and SAVE are nationally deployed and functioning. Due to 
uncertainty regarding how and whether the five electronic systems will work, how they 
will be integrated, and how they will ensure the protection of data, their use should not be 
required by federal law or regulation. Rather, states should be permitted to use existing 
verification processes to comply with federal requirements. 

• Establish a unique symbol to indicate that a license or identification card complies 
with federal requirements. States should retain the authority to issue DL/IDs that do 
not meet federal standards. In order to differentiate between DL/lDs that meet federal 
requirements and those that do not, DHS should work with states to designate a means to 
easily identify federally compliant DL/lDs. 

• Provide greater clarification and flexibility regarding physical security 
requirements. Not all departments of motor vehicles issue DL/IDs through the same 
process; some use central issuance (Cl), others use over-the-counter issuance (OTC) and 
some use a hybrid CI/OTC process. Therefore, DHS should allow states to utilize a 
combination of security features designed to protect the physical integrity of DL/IDs. 
Many states have processes in place to issue, maintain, and protect DL/ID information. 
Federal law and accompanying regulations should provide flexibility in how states 
prevent tampering, counterfeiting, or unauthorized duplication of DL/IDs for fraudulent 
purposes. 

• Establish minimum guidelines for the further protection of personally identifiable 
information. DL/ID information is protected by federal and state Driver Privacy 
Protection Acts (collectively, DPPA). However, since the federal DPPA was enacted 
well before REAL ID, DHS should establish further minimum guidelines to address 
requirements to protect the security, confidentiality, and integrity of personally 
identifiable information that could not have been contemplated at the time of DPPA 
enactment. 

• Establish a process to allow states greater flexibility in validating an applicant’s 
identity under exceptional circumstances. States should be permitted to establish a 
process to validate an applicant’s identity in rare cases where the applicant is unable to 
present the documents specified in the act. 

• Recognize enhanced driver’s licenses as being compliant with REAL ID. Enhanced 
driver’s licenses issued by states should be considered compliant with requirements for 
secure state DL/IDs. 

• Establish a demonstration program to evaluate electronic information sharing 
among states. The hub system envisioned by DHS in the final REAL ID rule is a 
complex and potentially costly endeavor and participation in the system should not be 
federally required. Instead, the federal government should facilitate a demonstration 
program among a few states to determine projected costs for such a system, the 
appropriate governance structure for administrative purposes, and the appropriate security 
and privacy measures to protect individuals’ personal information. 

• Provide access to federal electronic systems. Access to any federal electronic systems 
that states are required to use to comply with the act should be provided free of charge, 
just as the E-Verily system is made available to employers without cost. 
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PROVIDING FOR ADDITIONAL SECURITY IN STATES’ IDENTIFICATION ACT OF 
2009 

NGA supports S. 1261 because it is built largely on governors’ recommendations for solving the 
problems inherent to REAL ID. For example, to address the issue of cost, PASS ID eliminates 
fees associated with the use of existing federally run databases that states must use to issue 
DL/lDs. It also allows states to innovate to meet security requirements and eliminates the 
requirement to use electronic verification systems that do not yet exist or are not nationally 
deployed. These changes combine to cut state costs of compliance with PASS ID to 
approximately half that of REAL ID. 

PASS ID also recognizes that currently only two of the electronic systems states must utilize 
under REAL ID exist and are nationally deployed: SAVE to verify immigration status and 
SSOLV to verify social security information. PASS ID would require the use of these systems 
but eliminate the need to develop costly new data systems that raise significant privacy and fiscal 
concerns without providing a measurable increase in security. Current work to develop an 
electronic database to share DL/ID information among states would be continued under a 
demonstration project. This demonstration project will allow states to examine the privacy, cost 
and governance issues involved in the development and use of such a system prior to their 
voluntary participation. 

Privacy concerns are addressed by PASS ID by requiring procedures to prevent the unauthorized 
access to or sharing of information, as well as requiring public notice of privacy policies and the 
establishment of a redress process for individuals who believe their personal information should 
be amended in records systems. As discussed above, PASS ID also eliminates the requirement 
to develop and use new electronic verification systems, a major concern of privacy right 
advocates. 

Finally, PASS ID ties timelines for issuance and full implementation to the completion of final 
regulations. Although not a true date-forward implementation schedule as called for by NGA, 
when combined with other enhancements, PASS ID would allow states to begin issuing 
compliant licenses and IDs faster than called for by REAL ID. 

REAL ID VERSUS PASS ID IN VERMONT 

In Vermont, we fiilly understand the need to ensure the integrity and security of the process by 
which we issue driver license and identification cards. Our state is working toward compliance 
with the law, but, as enacted, REAL ID poses significant challenges for our state. PASS ID will 
also require significant changes to our system, but its elimination of unnecessary systems and its 
cost make it a far better alternative. 

One example in which both REAL ID and PASS ID pose a challenge for Vermont is with their 
requirement to have a photo on the license or ID. Although this provision is already the norm in 
most states, it actually presents Vermont with a significant challenge. Vermont was the last state 
to require a mandatory photo driver’s license or identification card, and that did not come 
without a significant battle. Even when the legislation was adopted, local culture demanded that 
current licensees were “grandfathered” from the photo requirement. As a result, approximately 
20 percent of our licensed drivers are still without a photo image on their license or identification 
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document. Although both REAL ID and PASS ID allow Vermont to continue to issue non- 
compliant driver’s licenses that will not be valid for federal purposes, both laws still place 
Vermont in the awkward position of having to maintain a dual system in order to maintain its 
local culture and customs. 

PASS ID is superior to REAL ID in terms of practical application and the likelihood of actual 
implementation. By eliminating the requirement to use national systems to check vital records, 
foreign passports and connect to all other motor vehicle departments in the country, PASS ID 
removes fiscal and operational uncertainties and will allow Vermont to issue compliant cards 
sooner. There exist significant challenges in developing the systems required by REAL ID and 
even greater doubt that the systems will be ready, reliable and nationally deployed in time for 
states to begin issuing fully compliant REAL IDs in 2011, In contrast, our state’s processes for 
validating documents like birth certificates and ensuring only one license per driver are rigorous 
and reliable and PASS ID further underscores the need for our vigilance. Consequently, in 
Vermont we feel that we can achieve the same level of security called for by REAL ID and do it 
sooner under PASS ID. 

In addition, PASS ID is more cost effective— a key consideration in these difficult fiscal times. 
The present cost estimate for states to implement REAL ID nationally is $3.9 billion. In 
Vermont we estimate it will cost us at least $20 million, meaningful dollars for a state our size 
and a severe roadblock to implementation of REAL ID. PASS ID eliminates unnecessary costs 
like the transaction charges for linking to and using federal systems, and authorizes some of the 
funding necessary for states to implement this program. These are giant steps towards covering 
the cost of compliance. In fact the National Governors Association, with the assistance of state 
stakeholders, estimates that PASS ID would cost approximately $2 billion, half the cost of REAL 
ID. 

One aspect of PASS ID that we particularly appreciate is the bill’s explicit recognition of 
Enhanced Driver’s Licenses (EDL). With Vermont’s close ties to the Canadian Province of 
Quebec, we very much value the importance of having an open, but secure, border. Vermont 
businesses both retain jobs and grow because of opportunities to sell products and services to our 
neighbors to the north. The United States and Canada enjoy the largest bilateral trading 
relationship in the world, with more than $1.3 billion in goods and services crossing the border 
every day. In today’s economic climate, a free and open border for Vermont manufacturers and 
retail businesses is more crucial than ever. 

Earlier this year, Vermont began issuing EDLs that are valid land and sea border crossing 
documents under the Western Hemisphere Travel Initiative, The process to obtain an EDL is far 
more involved than a regular license; it includes: 

• additional proofs of identity 

• proof of citizenship 

• one-on-one interviews with trained DMV security staff 

• a requirement that issuing staff have undergone FBI background checks and must be US 
citizens 

• a requirement that licenses be produced in a secure factory and mailed to customers 
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• a requirement that licenses contain Machine Readable Zones (MRZ) and Radio 
Frequency Identification (RFID) tags 

The importance of Vermont’s EDL being recognized as compliant with federal driver’s license 
standards cannot be understated as Vermont’s economic, environmental and cultural relationship 
with Quebec is of paramount importance. The EDL cost Vermont about $1 million to 
implement, but more importantly the ease of border travel it creates is key to our economy and 
our relationship with Canada, Vermont’s largest trading partner. 

If the Vermont EDL were not recognized as REAL ID compliant, citizens would be faced with a 
difficult choice - either carry an EDL for land border crossings to Quebec or carry a REAL ID 
compliant card for flying and/or accessing federal buildings. If Vermont’s EDL is not compliant, 
it would become essentially useless as most customers would be better off obtaining a regular 
license and also maintaining a passport or passport card for border travel. 

CONCLUSION: 

Since its passage, governors have consistently offered constructive recommendations for 
implementing REAL ID. Governors have encouraged DHS and Congress to “fix” the act by 
implementing statutory or regulatory changes to make REAL ID feasible and cost-effective. 

They also have called on the federal government to “fiind” REAL ID by providing federal 
dollars to offset state expenditures for meeting new federal standards. 

PASS ID represents the type of commonsense solution governors have long sought. Governors 
support PASS ID because security of our nation is not a partisan issue. Every governor is a 
security governor. Every governor is interested in making government work. PASS ID 
represents a workable, cost-effective solution that can increase the security and integrity of all 
state license and identification systems. 

Qn behalf of the National Governors Association, I would like to express governors’ strong 
support for S. 1261 and encourage this committee to take up the legislation and report it 
favorably to the Senate as soon as possible. 
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Chairman Lieberman, Ranking Member Collins, and distinguished members of this 
Committee, I am pleased to appear before you today to discuss the importance of REAL ID to 
our physical and economic security, 

I. Dangers of Insecure Identification 

In this country, the document that most people use to identify themselves is not issued by 
the federal government and was not originally intended as an identity document. State driver’s 
licenses were originally designed to verify that the holder had passed a driving test and was 
allowed to drive. But over the years, they have become the primary identification document for 
almost everyone over the age of sixteen. They are used to buy liquor and cigarettes, to enter 
federal buildings, to board airplanes, and to cash checks. 

Our reliance on licenses issued by fifty-six jurisdictions to prove identity creates special 
problems. It means that there are fifty-six different standards and fifty-six different notions of 
how much security should be built into the document and the issuance process, based on fifty-six 
different state and territory budgets and policies. Given the ease with which people travel 
interstate, it is all too easy for criminals and terrorists to exploit security holes in the weakest 
state license procedures. 

9/1 1 brought this lesson to life. At least six of the hijackers used state-issued 
identification cards to check in at the airport on the morning of 9/1 1, many of them obtained 
fraudulently. Among them, the hijackers possessed thirty different identification documents, and 
some possessed identifications from multiple states. 

Timothy McVeigh also took advantage of insecure identification procedures. In 1 995, he 
was able to create a fake South Dakota license with ease; all it took was a manual typewriter and 
a kitchen iron. He used the license to rent a Ryder truck in Oklahoma and destroy the Murrah 
Federal Building, 

Terrorist attacks are not the only dangers of insecure identification, False identification 
documents have enabled the millions of instances of identity theft that occur every year, identity 
thieves use other people’s personal information to obtain driver’s licenses and other forms of 
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identification. Then they use the identification to take actions, like obtain medical treatment and 
open bank accounts, in other people’s names. 

The 9/1 1 Commission concluded, “For terrorists, travel documents are as important as 
weapons.”' The Commission emphasized the dangers that result from insecure identification: 
“Fraud in identification is no longer just a problem of theft. At many entry points to vulnerable 
facilities, including gates for boarding aircraft, sources of identification are the last opportunity 
to ensure that people are who they say they are and to check whether they are terrorists.”^ The 
Commission’s recommendation was equally direct: “The federal government should set 
standards for the issuance of birth certificates and sources of identification, such as driver’s 
licenses.”’’ 

REAL ID puts the recommendations of the 9/1 1 Commission into law. By requiring 
protections such as allowing stale Departments of Motor Vehicles (DMVs) to check the records 
of other state DMVs, verifying the documents like birth certificates and social security cards that 
people use to get licenses, and prohibiting people from using insecure identifications to board 
airplanes or enter federal buildings, REAL ID keeps us safe. 

11. Strengths of REAL ID 

A. REAL ID Protects Our Privacy 

Critics claim that REAL ID is a threat to privacy. This is false. 

The claim that REAL ID threatens privacy has helped to stall driver’s license security. 
But the result of the delay is not more privacy. It is less. People whose identities have been 
stolen with the help of a fake or fraudulent driver’s license are victims of the delay — indeed, they 
are victims of the “privacy” advocates who have campaigned against REAL ID. 

They’ve suffered real losses, and a real invasion of their privacy, because people who 
claim to speak for privacy have been fighting to prevent good driver’s license security. 

Repealing or gutting the requirements of REAL ID will create hundreds of thousands 
more privacy victims over the next few years. A substantial number of identity thieves have 
used fake driver’s licenses to commit their crimes, and making licenses harder to forge will make 
this crime harder to perpetrate. By requiring verification of documents such as birth certificates, 
REAL ID will make it harder for criminals to forge documents that allow them to obtain 
identifications. Additionally , the three kinds of security features that REAL ID requires on every 
card will make it harder for criminals to forge the identifications themselves, 

I have yet to hear a coherent explanation of the claim that REAL ID is bad for privacy. 
Surely privacy is not improved by a bad identification system. The closest thing to a coherent 


' The 9/1 1 Commission Report, p. 384, 
’ Id. at 390. 

’Id. 
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argument is based on the false claim that REAL ID would create a national database of 
individuals’ personal information. Under REAL ID, state DMVs, not the federal government, 
will continue to control driver’s license data. REAL ID simply allows state DMVs to access the 
databases of other state DMVs — something that law enforcement officials can do now every 
time they perform a traffic stop. No additional databases are created and there is no aggregation 
of personal data. 

Moreover, thanks to REAL ID, that data will get additional protection from disclosure. 
State DMVs will have to meet tough new security standards for that data. Among other 
measures, states will have to ensure the physical security of facilities used to create identification 
documents and store personal information, perform background checks on employees involved 
in the manufacture of REAL ID identifications, and formulate emergency response plans. 

REAL ID does not create a national identification card. States will continue to issue 
identifications, and no one is required to have one of these cards. If anything, REAL ID 
eliminates the need for a national identity card because individuals will have secure state-issued 
identification. 

B. REAL ID is an Affordable Protection 

The importance of secure identification cannot be overstated. Many would argue that we 
should spend whatever it takes to ensure that individuals in this country have secure 
identification. Fortunately, the cost of REAL ID measures is not that high, especially when 
compared to the cost of the system already in place. 

The federal government has provided states with grants for REAL ID implementation and 
modified compliance requirements. When it announced the final REAL ID regulations in 
January 2008, the federal government made $360 million available to states — $80 million In 
dedicated REAL ID grants and $280 million in general homeland security funding. It also cut 
the amount that states would have to spend by almost three-quarters by extending the enrollment 
deadline. Originally states would have to produce compliant identifications for all driver’s 
licenses by 2013. But federal regulators included phase-in requirements in the REAL ID 
regulations that allowed states to first become compliant with licenses of those under fifty years 
old by 2014, and those over fifty years old by 2017. Since REAL ID regulations came into effect 
in January 2008, the federal government has made even more grant money available to states. 
Some of this money, such as the nearly $50 million that former Secretary of Homeland Security 
Michael Chertoff released in December 2008, remains unspent. 

The federal government has provided and continues to provide substantial financial 
assistance to states implementing these important protections. No matter the exact cost of REAL 
ID implementation — which DHS estimated in January 2008 to be just $8.30 per person — it 
outweighs the high costs of tenorist attacks and identity theft. 
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in. Changes that Must be Made to PASS ID 

As currently written, PASS ID gives us a false sense of security: it returns us to pre-9/1 1 
standards for the issuance of identification documents while leading us to believe that these 
documents are secure and enabling us to do more with these documents. There are no easy 
solutions to the problem of secure identification, but if legislators are intent on replacing REAL 
ID with PASS ID, there are several changes that must be made. Below, I have identified PASS 
ID’S greatest weaknesses and suggested ways to fix them. 

A. PASS ID Must Require Breeder Document Checks 

1. PASS ID Problems 

Eighteen of the nineteen 9/1 1 hijackers obtained government-issued identification in the 
U.S. They used these documents to rent cars, lease apartments, open bank accounts, and board 
airplanes. The problem was not that the identifications themselves were forged. The 
identifications were valid, but many were based on false documents. To prevent this from 
happening, REAL ID requires states to verify the validity of birth certificates and other breeder 
documents that individuals use to obtain identifications. PASS ID does not. 

There is no point in having hard-to-forge licenses if they can be obtained simply by 
showing other documents that are easily forged. The U.S. Government Accountability Office 
(GAO) released a report in March detailing how a GAO inspector was able to obtain four 
passports, each time using a counterfeit birth certificate.'’ The report noted that one reason that 
the inspector was able to get the passports was because the Department of State could not 
conduct real-time verification of the birth certificates. Instead, government officials responsible 
for verifying the validity of the documents did so only by inspecting them. That’s what state 
DMVs have to do now, And if the State Department cannot figure out which birth certificates 
are forged, how do we expect DMV clerks to do better? Social security cards are similarly 
insecure. Imposters can easily forge our social security cards, and, as a recent Carnegie Mellon 
study reports, individuals’ social security numbers can be guessed with remarkable accuracy.^ 

2. Solutions 

It is relatively inexpensive to perform breeder document checks, and several states are 
already performing them. One electronic verification system approved under REAL ID, 
Electronic Verification of Vital Events (EWE), is up and running in fifteen states, and five more 
states will be using EWE by the end of 2009. EWE would allow every state DMV to 
electronically verify the birth certificates of applicants for driver’s licenses and identifications, 
even those of applicants from different states. Officials enter a query into the EWE database, 
and seconds later receive a response stating whether the birth certificate is valid or not. The 
electronic verification is secure and accurate. All confidential information is encrypted, and all 


U.S. Gov’t Accountability Office, Dept, of State, GAO-09-447, Undercover Tests Reveal 
Significant Vulnerabilities in State’s Passport Issuance Process (2009). 

* Researchers: Social Security Numbers can be Guessed, Wash. Post, July 7, 2009, at A2. 
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personal information remains in state databases, not in a centralized database. Three state DMVs 
currently use EWE to verify birth records. 

EWE is an inexpensive system to operate. A recent DHS grant of $4 million is enough 
to install EWE capability in all fifty states by May 2011, add a batch process to make the 
system more efficient, and perform an independent security check on the system, Digitizing 
state records will add to the cost, but all remaining birth records could probably be digitized for 
less than $100 million. After these start-up costs, EWE will be even less expensive. Each query 
will cost just pennies, and because it will take seconds, instead of the days that it takes to 
perform a paper query, will save uncaiculated other costs. 

Other government offices recognize the benefits of EWE, The U.S. Office of Personnel 
Management uses EWE to verify vital records, as do several state Medicaid offices and 
departments of health. All 1,500 Social Security Administration offices are using EWE and are 
finding benefits even though just fifteen states have EWE up and running. These offices 
recognize that EWE can cut down on fraud in areas of regulation beyond the issuance of 
identifications. 

There are other inexpensive and easy-to-use systems already in place that can allow for 
the verification of breeder documents. There is currently an agreement in place between DHS 
and the State Department that allows DHS to check individuals’ passport records and verify the 
identity of the person presenting the passport. This system is used at our country’s borders every 
day, and about 130,000 employers use it when hiring individuals to make sure that they are 
eligible to work in the United States. It is not an expensive or difficult process — any employer 
with access to the internet can perform these checks. It would not be difficult for fifty more 
entities to use this system. 

The language of PASS ID should be changed to require breeder document checks. 
Suggested language is attached at “Attachment 1.” 

B. PASS ID Should Not Contain a “No Identification Needed” Clause 
1. PASS ID Problems 

The PASS ID bill states that “no person shall be denied boarding a commercial aircraft 
solely on the basis of failure to present a driver’s license or identification card issued pursuant to 
[PASS ID].’’ This clause threatens passenger safety and will create endless legal headaches. 

Currently, as a matter of policy, the Transportation Security Administration shows 
flexibility in deciding whether passengers may board airplanes without identification. If 
passengers forget their identification, do not have identification, or refuse to present 
identification, they will be subjected to additional screening measures, but they may still be 
allowed to board if TSA is satisfied that they do not present a security risk. 

There is a big difference, however, between implementing this practice through TSA 
policy, as TSA does currently, and creating a rigid statutory right, as PASS ID proposes. 
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The inclusion of this clause in PASS ID will not simply ratify TSA’s current policy. 
Instead it will encourage privacy groups and others to launch litigation designed to overturn 
TSA’s current policy. Every word of the provision will be scrutinized, and the courts are bound 
to have surprises for TSA. For example, suppose TSA officials spend so long interrogating the 
ID-less passenger that he misses his flight. Has the passenger been “denied boarding a 
commercial aircraft solely” because he didn’t have ID? If he’d had ID, he would have caught the 
flight, so that’s not an implausible reading, but it would allow passengers without ID to cut off 
follow-up questions just by saying that their flight was leaving. 

Second, what does it mean to deny boarding “solely on the basis of failure to present a 
driver’s license?” The clause invites the courts to decide whether TSA has what the courts 
consider an adequate reason other than the lack of an ID. That’s because judges will be urged to 
see denial of boarding in these situations as punishment for failure to present identification. But 
punishing a traveler for exercising a statutory right is not something that the courts are likely to 
find. To prevent TSA from denying boarding for a bad reason, courts will demand that TSA 
identify with specificity the reasons a passenger was denied boarding, and then the courts will 
decide whether those reasons are acceptable. 

Let’s think about what that will mean in practice. What if the TSA official questions the 
passenger and is still suspicious about him or her after the questioning? In August 2001 , this and 
not much more is what kept the “twentieth hijacker” out of the country. The border official in 
Orlando got a “creepy” feeling from Mohammed al-Qahtani and would not let him enter the U.S, 
If a TSA officer offered the same reasons for not boarding an ID-less passenger, will all courts 
agree that a lack of ID plus a general suspicion is enough to deny boarding? Or will the courts 
decide to require even more specificity from TSA as a way of preventing TSA from 
surreptitiously punishing ID-less travelers? 

If they do, and I suspect they will, then TSA tvill have to protect itself and its staff from 
judicial second-guessing, so TSA lawyers will end up drafting scripts and giving guidance about 
which questions and which answers form an acceptable basis for denying boarding. Judgment 
will go out the window, and checking boxes will be the way security is implemented. Worse, 
once these scripts become public, and it becomes clear what boxes are being checked, it will be 
easy for anyone to exploit the predictability in our security system to evade controls. 

The US air security system depends on identifying the people who should not be allowed 
on a plane without careful scrutiny. If the system can be defeated by simply refusing to carry 
identification, then the system becomes much easier to beat. Why would we want to make it 
easy to beat the air security system by creating a statutory right to fly without ID? What 
problem, exactly, is this provision trying to solve? 

2. Solutions 

There is one problem that the provision may be intended to address. Under REAL ID, 
TSA arguably didn’t have discretion to accept noncompliant licenses. Under that reading, states 
that did not adopt REAL ID standards might see all of their citizens turned away at the airport, 
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even if TSA were quite confident of the passengers’ identity. I don’t think that was a correct 
reading of the law, but it was not completely implausible. If this Committee wants to remove 
that problem, though, there is no need to create an open-ended statutory right to fly without ID. 

The language of the PASS ID bill could simply be changed to give TSA discretion to 
determine when passengers should and should not be allowed to board. That would ensure that 
TSA’s current discretion remains part of the security framework. 

Alternatively, the provision should be amended to avoid endless litigation by making 
clear that it does not confer on passengers the right to bring suit but rather is intended simply to 
give guidance to TSA. Suggested language to this effect is attached at “Attachment 2” at the end 
of this statement. 

C. PASS IP’s Nine-Month Deadline for the Passage of Rules is Impossible to Meet 
1. PASS ID Problems 

PASS ID requires that rules implementing its new requirements be adopted within nine 
months. All other deadlines in the act are measured from the date on which the regulations take 
effect. It’s a good thing for the authors of PASS ID that the truth in advertising laws don’t apply 
to Congressional bills. Because the deadlines in PASS ID are all phony. We will never get 
driver’s license security on the schedule that PASS ID purports to establish. 

PASS ID gives the impression that license security will improve quickly because of the 
deadlines in the bill. But the bill in fact creates great new incentives and opportunities for delay. 
By making all security improvements wait until regulations take effect, PASS ID issues an open 
invitation to everyone who dislikes the bill: “Stall the regs as long as you can; because as long 
as they haven’t been issued, you won’t have to do anything at all.” Even stales that want to 
comply quickly and that can comply quickly will be slowed down. 

It won’t take much stalling to blow out the nine-month deadline. In fact, existing law 
makes it impossible to issue serious rules in nine months. Under existing executive orders, any 
proposed rules drafted by DHS must be submitted to the Office of Management and Budget 
(0MB), which may spend 90 days reviewing them. Next, the Administrative Procedure Act and 
executive orders call for DHS to make the proposed rules available for public comment for 60 
days. Once DHS has responded to all of the comments and incorporated the appropriate ones 
into the final version, DHS must send them back to 0MB for 90 days. Finally, DHS must 
submit the rules to Congress for a 60-day review period before they become final. 

If you’ve been doing the math, you’ll see that the numbers don't add up. Or rather, they 
add up too fast and too high. 90 days for 0MB to review proposed rules, plus 60 days for public 
comments, plus 90 days for 0MB to review final rules, plus 60 days for Congressional review — 
that adds up to ten months. So even if DHS could do all of its drafting in 24 hours, it cannot 
meet the nine-month deadline. 
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And there’s no way DHS can do its work in anything like 24 hours. Drafting a regulation 
is plenty of work, but it’s just the beginning of the homework that goes into any new regulation. 
Here’s a sample of the other work that has to be completed to issue a regulation: 

• Regulatory Flexibility Act (5 U.S.C. §§ 601-612): DHS must assess the impact of its 
regulations on “small entities” like small businesses and small governmental 
organizations and prepare “regulatory flexibility analyses” for both the proposed and 
final rules. If those small entities don’t like the analysis, they can sue to stop the reg. 

• Unfunded Mandates Reform Act (2 U.S.C. §§ 1501-1571): DHS must prepare several 
reports, including specific cost estimates for both the proposed and final versions of 
certain rules affecting state and local governments, plans to notify affected small 
governments of regulatory requirements, and processes to allow local officials to provide 
input into the development of regulatory proposals. 

• National Environmental Policy Act (42 U.S.C. §§ 4321-4347): DHS must prepare an 
initial environmental assessment to determine whether the rules will cause a significant 
impact on the environment, and then prepare a full “environmental impact statement” if it 
determines that there will be a significant impact. 

• Executive Order 1 3422: DHS must provide an estimate of the regulatory costs and 
benefits of the proposed rules. 

• Executive Order 13132: DHS must develop a process to ensure meaningful input by state 
and local officials. 

• Executive Order 12988: DHS must ensure that It complies with specific requirements to 
improve regulatory drafting. 

• Executive Order 13175: DHS must not promulgate regulations not required by law that 
have tribal implications unless the agency provides funds or consults with tribal officials. 

• DHS must give careful consideration to all of the comments on any proposed rule and 
explain why it does or does not agree with them. (The original proposed rule for REAL 
ID attracted 21,000 public comments.) 

It will take months to comply with all of these substantive and procedural requirements, 
and several of them offer opportunities to litigate, a tactic that could force years more delay 
before we see implementation of the security measures that PASS ID calls for. 

How long will it take? Well, it took nearly three years to promulgate rules under REAL 
ID, and that was with a clear signal from the Secretary that the regulations were a high priority 
and without litigation. It could easily take five years or more. Under the legislation, DHS would 
have missed the Congressional mandate by more than four years, and it would be pilloried if any 
terrorist act in those four years took advantage of existing driver’s license security flaws. 1 do 
not believe that this Committee, of all committees, should set DHS up to fail so disastrously. 

There is no need to wait that long just to get started on the security measures in PASS ID. 
Particularly since those requirements seem to have been written more or less by applying 
Microsoft’s paragraph-delete function to the existing REAL ID regulations. I’ve attached to my 
testimony a chart (“Attachment 3”) that shows how closely the substantive requirements of 
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PASS ID track existing regulations. In fact, it’s fair to say that PASS ID simply adopts the first 
half of REAL ID compliance, originally scheduled to take effect at the end of this year, and 
drops the rest of REAL ID’s requirements. Seventeen of the eighteen REAL ID regulatory 
benchmarks for this stage of REAL ID (also called material compliance) are also part of PASS 
ID.*^ 


These requirements are not a surprise. The states have been working toward those 
benchmarks for years. Indeed, when the states accepted federal grant money under REAL ID, 
they agreed to meet the federal government’s deadline for those eighteen benchmarks. That 
deadline was the end of this year. Are we really going to delay progress on those benchmarks 
for three to five years just so that a few paragraphs of the Code of Federal Regulation can be 
reissued? 

I hope not. There are two ways to avoid this result. If Congress really wants new 
regulations and it really wants them issued in nine months, then Congress should waive the host 
of statutes and executive orders that currently slow the regulatory process. 

Alternatively, Congress could simply declare that the existing regulations provide a good 
start and that many of them will remain in effect until revised. Instead of imposing pointless 
years of delay, that solution would save nine months, since the states could begin implementing 
them immediately (something the states have already told DHS they can do). DHS can at the 
same time modify the regulations as it sees fit and on a reasonable schedule. 

2. Solutions 

i. Waive the Requirements of the Above Laws and Executive Orders 

Waiving the regulatory process laws and Executive Orders set out above would make it 
feasible for DHS to issue rules within nine months. Without a required comment period and 
without the various impact statements and 0MB review, it’s possible that DHS could get a large 
regulation out in nine months. But I frankly doubt that such a waiver would be politically 
feasible given the many constituencies that have invested in those procedures. 

ii. Leave in Place the Regulations Found at 6 C.F.R. § 37.1 et seq. 

The more practical and faster option would be to simply leave many of the current rules 
in place. Most of the rules at 6 C.F.R. § 37.1 et seq. are consistent with PASS ID, as shown by 
Attachment 3. It makes no sense to invalidate rules that have already gone through the entire 
process described above when PASS ID draws so heavily on those same rules. At the ver>’ least, 
these rules should remain in place until the adoption of new rules. 

Proposed language for this option is attached at “Attachment 4.” 


*’ Benchmark #10’s requirement that the card contain the full legal name of the applicant is 
inconsistent with PASS ID. The rest of benchmark #10 is consistent with PASS ID. 
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D. PASS ID Should Impose Conditions on the Grants to be Given to States 

1, PASS ID Problems 

DHS issues hundreds of millions of dollars to states every year to spend on homeland 
security efforts. States normally spend this money on items that make their own residents safer, 
such as fusion centers or equipment for first responders. These are worthwhile expenditures. 

But the money the states are spending comes from taxpayers all over the country. Surely, 
then, it should be spent first on measures that will help make the entire country safer. 

Driver’s license security is one such measure. Because state driver’s licenses are accepted 
everywhere, weaknesses in one state’s ID security put us all at risk, and we should insist that 
states give the highest priority to expenditures that will close those security gaps. 

2. Solutions 

Congress should include a provision in PASS ID that requires states to make driver’s 
license and identification security a top priority when spending state homeland security grants. 
Suggested language can be found at “Attachment 5.” 

IV. Conclusion 

The importance of secure identifications cannot be overstated. Insecure identification 
documents based on unverified documents themselves enable crimes from terrorism to underage 
drinking. This truth was highlighted in the 2007 Fort Dix terrorism plot. There, secure 
identification laws made it possible for federal officials to interrupt the plot. Three of the 
individuals plotting to attack the fort were in the U.S. illegally, and under a New Jersey law 
requiring proof of lawful presence to obtain identification documents, they could not obtain 
identification. Because the men could not buy weapons legally without identification, they were 
forced to buy them illegally. This provided undercover law enforcement agents with enough 
evidence to stop the plot, and they interrupted the terrorists’ plans. 

Nearly all states are implementing elements of REAL ID. About sixteen states publicly 
support REAL ID and are working towards achieving REAL ID regulations’ “material 
compliance” benchmarks. Other states that did not initially support REAL ID have reversed 
their position. A good example is Maryland. At the time of REAL ID’s passage, Maryland 
legislators called for a repeal of the Act. By December 2008, however, officials understood the 
importance of REAL ID and in April, the governor signed legislation that guaranteed REAL ID 
compliance. Other states have quietly indicated their support of REAL ID. For example, the 
governor of Oregon signed an e,xecutive order in 2007 requiring the state to abide by standards 
even stricter than those of REAL ID in issuing driver’s licenses. 

With this steadily growing support of REAL ID and the undeniable truth that secure 
identifications protect us, REAL ID should not be abandoned, If legislators are intent on 
amending REAL ID, the recommendations I have described will help to ensure that PASS ID 
keeps us safe and protects our privacy. 
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Attachment 1 

Proposed language for § 242(c)(3) of PASS ID: 

SEC. 242. MINIMUM DOCUMENT REQUIREMENTS AND ISSUANCE STANDARDS 
FOR FEDERAL RECOGNITION. 

(c) MINIMUM ISSUANCE STANDARDS 


(3) VERIFICATION OF DOCUMENTS.— To meet the requirements of this 
section, a State shall implement the following procedures — 

(A) Not later than two years from the date of the enactment of this Act a State 
shall make available to each other State a complete set of electronic birth 
records, and shall, before issuing a driver’s license or identification card to 
a person, verify the birth record of each person seeking a license by means 
of these electronic records. 

I . States shall where possible prefer U.S, passports for purposes of 
identification. The State shall perform an online verification of the 
passport that includes a verification of the person’s photograph. 
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Attachment 2 

Proposed language for § 242(a) of PASS ID; 

SEC, 242. MINIMUM DOCUMENT REQUIREMENTS AND ISSUANCE STANDARDS 
FOR FEDERAL RECOGNITION. 

(a) MINIMUM STANDARDS FOR FEDERAL USE.— 

(1) IN GENERAL — Beginning 1 year after the date on which final regulations are 
issued to implement this subtitle, pursuant to section 5 of the PASS ID Act — 


(B) to board a federally regulated commercial aircraft, a person must present 
identification that the Transportation Security Agency in its sole discretion 
deems sufficient in the circumstances. Nothing in this subsection shall be 
construed to create any legally enforceable right. 
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Attachment 3 


PASS ID Section 242: Minimum Document 
Requirements and Issuance Standards for 
Federal Recognition 

Corresponding REAL ID Regulations 


6C,F.R. § 

37.1 


6C.F.R. § 

37.3 


6 C.F.R. § 

37.51 

(a) Minimum Standards for Federal Use 

6 C.F.R. § 
6 C.F.R. § 

37.55 

37.59 


6 C.F.R. § 

37.61 


6 C.F.R. § 

37.63 


6 C.F.R. § 

37.65 


6 C.F.R. § 

37.3 

(b) Minimum Document Requirements 

6 C.F.R. § 
6 C.F.R. § 

37.15 

37.17(b)-(n) 


6 C.F.R. § 

37.19 

' 

6 C.F.R. § 

37.71 


6 C.F.R. § 

37.3 


6 C.F.R. § 

37.1I(a)-(f) 

(c) Minimum Issuance Standards 

6 C.F.R. § 
6 C.F.R. § 

37.11(1) 

37,21 


6 C.F.R. § 

37.23 


6 C.F.R, § 

37.25 


6 C.F.R. § 

37.27 

(d) Other Requirements 

6 C.F.R. §37.3 

6 C.F.R. § 37, 29(a) 

6 C.F.R. §37.31 (b)-(c) 

6 C.F.R. §37.41 

6 C.F.R. § 37.43 

6 C.F.R. §37.45 


iii 
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Attachment 4 


Proposed language for § 5{a) of PASS ID: 

Sec. 5. RULEMAKENG 

(a) fN GENERAL — Not later than 9 months after the date of the enactment of this Act. 
the Secretary, after providing notice and an opportunity for public comment, shall 
issue final regulations to implement subtitle E of title II of the Homeland Security Act 
of 2002, as added by section 3. 

(!) Until and unless superseded by further regulations, the following regulations, 
except as they relate to timing deadlines, shall implement this Act. 

(A) 6C.F.R. § 37.1 

(B) 6 C.F.R. § 37.3 

(C) 6C.F.R. § 37.5 

(D) 6 C.F.R. §37.1 l(a)-(f); 6 C.F.R. §37.1 l(i) 

(E) 6 C.F.R. §37.15 

(F) 6 C.F.R. §37.1 7(b)-(n) 

(G) 6 C.F.R, §37.19 

(H) 6 C.F.R. §37.21 

(I) 6 C.F.R, § 37,23 

(J) 6 C.F.R. § 37.25 

(K) 6 C.F.R. §27.27 

(L) 6 C.F.R. § 37,29(a) 

(M) 6 C.F.R, §37.3 l(b)-(c) 

(N) 6 C.F.R. §37,41 

(O) 6 C.F.R. § 37.43 

(P) 6 C.F.R. § 37.45 

(Q) 6 C.F.R. Subpart E 

(R) 6 C.F.R. § 37.71 

(2) Timing deadlines in the regulations identified in paragraph (1) shall be established 
by the Secretary of Homeland Security by publication of a notice in the Federal 
Register . 


iv 
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Attachment 5 

Proposed language for § 244 of PASS ID: 

SEC. 244. GRANTS TO STATES 


(c) OTHER GRANTS. — In awarding grants to States designated for homeland security 
through the Department of Homeland Security’s State Homeland Security Program, DHS 
shall require that improving driver’s license and identification security shall be a priority, 
and in particular shall be prioritized above expenditures that do not improve security on a 
nationwide basis. 


V 
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Testimony before the United States Senate 
Committee on Homeland Security and Governmental Affairs 

Hearing on “Identification Security: Reevaluating the REAL ID Act" 

Leroy D. Baca 

Sheriff, Los Angeles County, California 
July 15, 2009 

Good Morning Chairman Lieberman, Ranking Member Collins, and Members of 
the Committee. My name is Lee Baca and I currently serve as the Sheriff of Los 
Angeles County, California and on the Board of Directors of the National Sheriffs’ 
Association (NSA). 

I am pleased to have this opportunity to appear before you today to express our 
support for S. 1261, The Providing for Additional Security in States' Identification Act of 
2009 (PASS ID). As the witnesses before me have addressed the problems and 
challenges associated with the implementation of REAL ID, my testimony will focus on 
the critical need for a national standard for identification security from a local law 
enforcement perspective, so that we are effectively integrated to ensure homeland 
security. 

We recognize that the proposal to issue a national standard for identification 
security has been a contentious issue. However, we believe that PASS ID adequately 
addresses the cost, policy and privacy concerns so as to protect the citizens that we 
serve. From a law enforcement perspective, it gives us that much more confidence that 
the identification we are looking at is authentic - that you are in fact who you say you 
are. It provides one more tool to ensure public safety. It is designed to make it much 


1 


q 


VerDate Nov 24 2008 09:40 Jun 06, 201 1 Jkt51792 PO 00000 Frm000117 Fmt 06601 Sf ml 06601 P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



114 


more difficult for terrorists, criminals and illegal aliens to tamper with official 
identification. 

In 2005, the National Sheriffs’ Association was asked to take a position on REAL 
ID. NSA discussed the issue at length and while the Association did not take an official 
position on the Act itself, we did support the concept of the need to develop a national 
standard for identification security. 

Recognizing the significant problems associated with REAL ID and the looming 
deadline for full compliance, the NSA Board of Directors reviewed and discussed the 
provisions of PASS ID and officially endorsed the proposal. In doing so, NSA became 
the first national law enforcement organization in the United States to endorse this 
proposal. 

Since the events of 9/1 1 , the significance of how local law enforcement might 
protect national security and the importance to homeland security measures have 
increased substantially. Sheriffs and their deputies play a critical role in homeland 
security efforts as the nation’s counterterrorism “eyes and ears.” Local law enforcement 
personnel are almost always the first to experience firsthand suspicious activities and 
first to respond to any terrorist event. Clearly, there is a compelling role for local law 
enforcement in which we make contributions to preventing and responding to local 
manifestations of terrorist threats. 

We must make communication and integration of federal homeland security 
efforts with local law enforcement a priority at the policy and operational levels. 
Information sharing is the mission-critical requirement to achieve homeland security, to 
protect the American public, and to defend against terrorism. Whether it’s an officer at a 
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traffic stop, an investigator at a crime scene, a first responder at a toxic spill, or an 
officer at the border, it is vital that we move forward in providing efficient, secure, and 
accurate identification across jurisdictional and technological boundaries. 

NSA believes that PASS ID is a logical solution and currently the only pragmatic 
approach to implement a national standard for identification security. The core of the 
PASS ID concept is premised on a practical approach to avoid the systematic malady of 
REAL ID including cost and privacy concerns. 

In light of the 9/11 terrorist attacks and the discovery that its hijackers boarded 
flights with fraudulent identification and the need for increased border security, it is 
readily apparent that we need to develop a national standard for identification security 
on state identification cards and driver’s licenses to prevent the ability of forging these 
documents and obtaining such state identification with fraudulent papers. 

We witness daily during the course of our law enforcement duties individuals who 
are routinely found to have counterfeit identification. While some fraudulent documents 
are easy for law enforcement to recognize as counterfeit, there are documents that are 
expertly crafted and almost impossible to detect as counterfeit. 

Such documents pose a dangerous risk to not only the law enforcement 
community, as we become unsure of the identities of individuals we have in our 
custody, but to the public, as we may release potentially dangerous individuals 
unknowingly into an unsuspecting public. 

Under PASS ID, the requirements necessary for obtaining state identifications 
and driver’s licenses remain as strong as they were with REAL ID. States will be 
required to validate the identity of an individual by checking several federal government 
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databases, including the Social Security database, and confirming his or her legal status 
with federal immigration services. 

Thus PASS ID would assist law enforcement in identifying citizenship or legal 
status of an individual through state identification cards and driver’s licenses. Such 
information is critical to local law enforcement in our border security efforts. In particular, 
the information will help to identify those individuals who are in the United States 
illegally, who are dangerous criminals or who could potentially pose a threat to national 
security. 

It would mandate that identification cards still contain the requirements from 
REAL ID, meaning that the cards would display a photo of the individual, the individual’s 
valid signature, and a machine-readable barcode on the back of the license or 
identification. The bar code would continue to contain the appropriate identification that 
would already be included on the ID, but presents it in a more readable form for law 
enforcement and continues to verify that an individual is who he or she claims. PASS ID 
would, however, prohibit the social security number of an individual from being included 
within the barcode or on the card itself to ensure that the individual is protected against 
identity theft. 

We are not declaring PASS ID as the end-all perfect solution and anticipate that 
further technological systems, laws and regulations will likely have to be developed and 
enforced to improve provisions under PASS ID. However, we believe that PASS ID is a 
significant and necessary step forward in establishing a much needed national standard 
for identification security to strengthen homeland security. We must accept that REAL 
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ID has not and will not be fully realized and that there is an urgent need to implement an 
alternative security measure as a starting point. 

Simply, the implementation of PASS ID would enhance law enforcement’s ability 
to identify and translate critical information to the officer on the street in an effort to 
ensure America’s public safety. 

I want to thank you for the opportunity to come before you today and express our 
support for S. 1261, The Providing for Additional Security in States’ identification Act of 
2009 (PASS ID). The National Sheriffs’ Association stands ready to assist Congress 
and the Administration in implementing PASS ID and creating a safer and more secure 
nation for all individuals. 
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Chairman Lieberman, Ranking Member Collins and distinguished members of the Committee, 
on behalf of the National Governors Association (NGA), thank you for the opportunity to testify 
today regarding the PASS ID Act (S. 1261) and how it would enhance the security of all driver’s 
licenses and identification cards. 

Overview 

The National Governors Association (NGA) is supportive of S. 1261, the Providing for 
Additional Security in States’ Identification Act of 2009 (PASS ID), because it would address 
the primary concerns that have led 12 states to enact legislation prohibiting implementation of 
REAL ID and nine others to enact joint resolutions in opposition to REAL ID (see Appendix A). 
States’ opposition stems from three long-standing state concerns: 1) REAL ID is a huge 
unfunded mandate; 2) the law’s reliance on electronic data systems raises significant privacy 
concerns; and 3) the law is problematic if not impossible to implement. 

In contrast to REAL ID, PASS ID was developed in close coordination with states and addresses 
states’ concerns by eliminating unworkable requirements of REAL ID, providing states 
flexibility to use innovative solution to meet federal requirements, and allowing all states the 
opportunity to participate in a more secure system for driver’s license and identification card 
(DL/ID) issuance. 

With the support of the National Council of State Legislatures (NCSL), the American 
Association of Motor Vehicle Administrators (AAMVA), and other key law enforcement and 
technology organizations, PASS ID offers an opportunity to fix a broken system ahead of a 
looming deadline at the end of this year. Under the REAL ID regulations, states must meet 18 
separate requirements in order for their DL/IDs to continue to be accepted for official purposes, 
such as boarding commercial aircraft. If PASS ID does not move forward before the end of this 
year, more than one-fifth of states’ citizens could find they no longer have proper identification 
to board commercial aircraft as they return from their holiday travels on January 1, 2010. 

History 

On May 11, 2005, Congress passed the REAL ID Act as part of the Emergency Supplemental 
Appropriations Act for Defense, the Global War on Terror, and Tsunami Relief Act (P.L. 109- 
13), creating national standards for the issuance of state DL/IDs. The act establishes certain 
standards, procedures, and requirements that must be met by May 11, 2008, if state-issued 
DL/IDs are to be accepted as valid identification by the federal government. 

While the act required compliance with its provisions by May 2008, the U.S. Department of 
Homeland Security (DHS) did not issue the final rule guiding implementation until January II, 
2008. The final rule incorporated many of the recommendations made by states, including the 
adoption of a 10-year compliance timeline that established milestones for states and provided 
some flexibility to manage the DL applicant pool, but maintained several requirements that pose 
significant challenges to states’ compliance. 

The final rule required states to be in compliance with REAL ID by May 11, 2008, unless the 
states received an extension from DHS. States were given until March 31, 2008 to request an 
extension. States were informed that if they did not negotiate an extension by the deadline, any 
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DLADs issued by that state would not be accepted for identification purposes to board 
commercial aircraft. 

If states demonstrate they have achieved material compliance, but have not reached full 
compliance by December 31, 2009, they may request a second extension until May 1 1, 2011. 
After the 2011 deadline, states are expected to issue fully compliant REAL ID cards. 

PASS ID: the Way Forward 

REAL ID is not working. With one-fifth of states not participating in REAL ID, it does not 
fulfill the 9/1 1 Commission recommendation to enhance the security of all DL/IDs. 

PASS ID offers a more secure path forward. It would keep the requirements of REAL ID that 
work while eliminating those that cannot be implemented. In doing so, PASS ID will offer those 
states with laws prohibiting compliance with REAL ID to participate in a more secure system for 
DL/ID issuance. PASS ID accomplishes this by making several key changes to reduce costs and 
strengthen privacy protections. 

Cost - The Office of Management and Budget estimated in the final rule for REAL ID that the 
law would cost states $3.9 billion over 1 1 years. To date, the Department of Homeland Security 
has distributed approximately $130 million in grants to help defray states’ costs. At a time when 
states across the country are facing a severe fiscal crisis and projected deficits of $200 billion 
over the next two years, there simply are not the resources to meet the federal mandates in REAL 
ID. 

PASS ID would reduce costs by eliminating the requirement to use three electronic databases 
that either do not exist or are not nationally deployed and in use by states. These databases 
(Electronic Verification of Vital Events, or EWE, to verify vital records like birth certificates; a 
system to verify U.S. passport information; and a system to allow states to share DL/ID 
information with each other) are one of the primary cost drivers under REAL ID, and leave many 
unanswered questions including how the systems will be governed, how they will be maintained, 
their ultimate cost, and how they will protect personally identifiable information. 

Rather than relying on costly new systems that raise significant fiscal and privacy concerns 
without providing a measurable increase in security, PASS ID would require states to utilize best 
practices that have been developed among states to authenticate applicants’ information, PASS 
ID would retain the requirement that states verify legal status and social security information 
through the Systematic Alien Verification for Entitlements (SAVE) system and the Social 
Security On-Line Verification (SSOLV) system. 

PASS ID also would eliminate the fees charged to states for the use of federal systems like 
SAVE and SSOLV. This change would bring the states’ use of these databases in line with the 
private sector’s use of systems such as E-Verify to check the legal status of job applicants. In 
addition, PASS ID would authorize the current DHS grant program to support state efforts to 
implement enhanced security measures for DL/IDs. This provision would ensure that all states 
receive a minimum amount of funding while allocating the remainder based on the relative 
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number of DL/lDs issued in a state and preserving flexibility for the Secretary to support 
innovative projects. 

Utilizing OMB’s cost estimates issued in the REAL ID final rule and information provided by 
states, NGA estimates that PASS ID could reduce the implementation costs of REAL ID by 
approximately half, from $3.9 billion to close to $2 billion. 

Privacy - Another major area of concern with REAL ID is its requirement for the use of 
electronic databases and the expanded sharing of personally identifiable information. As 
discussed above, PASS ID would remove the requirement to utilize three electronic databases 
that either do not exist or are not nationally deployed. PASS ID, however, does continue work to 
develop these systems through a pilot program. For instance, the State of Mississippi is currently 
leading efforts to develop a “hub” system for states to share DL/ID information. PASS ID 
authorizes this to continue through a pilot program that will closely examine the governance, 
privacy, and cost issues that must be addressed in the development of any new system. Once 
these questions have been answered, states would have the option to participate in the systems. 

In addition, PASS ID includes requirements to prevent the unauthorized access to or sharing of 
information; requires background checks for employees who will have access to personally 
identifiable information; and requires public notice of privacy policies and the establishment of a 
redress process for individuals who believe their personal information should be amended in 
state systems, PASS ID also would provide better protection of information contained in the 
DL/ID’s bar code and would restrict the copying, trading, or sale of information on the bar code 
unless such use is consistent with federal, state, or local laws. 

Common Misperceptions 

Since its introduction, PASS ID has generated strong interest that has sometimes resulted in 
inaccurate reporting and analysis. I’d like to take this opportunity to clarify exactly what 
changes PASS ID would make to existing law and the impact these changes will have. 

Appendix B includes a chart showing the 18 benchmarks required for material compliance under 
REAL ID and the changes made by PASS ID. As you’ll see, PASS ID would continue to require 
all but two of these benchmarks. The following summarizes some of the key provisions of 
REAL ID that are retained by PASS ID: 

• Security Standards - PASS ID would establish national security standards for DL/ID 
issuance, including multiple security features to protect the physical integrity of the 
identification document; requirements for the physical security of DL/ID issuance and 
processing facilities; requirements and standards pertaining to the identity documents that 
may be accepted by a state department of motor vehicles (DMV) from a DL/ID applicant; 
and record retention standards. 

• Legal Presence - PASS ID retains the REAL ID requirement that a DL/ID applicant 
must be legally present in the United States. The categories of individuals eligible for a 
PASS ID are the same as those under REAL ID. 
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• Standards for Source Documents - REAL ID established national standards for source 
document verification that rely upon untested electronic systems that are not fully 
developed. For instance, while several states have begun utilizing the EWE system to 
check birth records, the information contained in these databases is incomplete, and 
therefore, insufficient to allow for electronic verification in all cases, 

PASS ID also establishes national standards for source document verification, including 
the use of federal databases to check legal status and social security information (SAVE 
and SSOLV). Rather than requiring the use of systems that are still under development 
and are unlikely to be deployed in time for states to meet the REAL ID deadlines, PASS 
ID requires the use of best practices to check such information through currently 
available means. PASS ID would continue to support the development of additional 
verification systems through a pilot program. 

• Compliance Marking - PASS ID would require states to clearly mark DL/IDs that are 
compliant with the law’s requirements. PASS ID would eliminate an unnecessary 
requirement of REAL ID to mark non-compliant cards as non-compliant because it does 
not contribute to security. 

• Implementation Timeline - Under REAL ID, states must be compliant with the 18 
benchmarks by December 31, 2009, and must be fully compliant by May 11, 201 1. Full 
compliance requires the use of the three electronic databases discussed above that are not 
implementable at this time. REAL ID then requires a tiered implementation timeline 
whereby states must ensure all residents age 50 or under have a compliant DL/ID by 
December I, 2014, and all those over the age of 50 by December 1, 2017. 

PASS ID ties implementation to the issuance of final regulations and could allow states to 
achieve compliance ahead of the REAL ID deadline. PASS ID requires DHS to issue 
final regulations within nine months of enactment. States must then begin issuing 
compliant DL/lD’s a year after final regulations and must complete enrollment five years 
after that. This means that if PASS ID is enacted this year, states would complete 
enrollment by September of 2016. 

• One driver, one license - PASS ID would require states to utilize best practices that have 
been developed by DMVs to help ensure that individuals do not hold more than one 
DL/ID. REAL ID requires this be accomplished through the electronic sharing of state 
DL/ID information with other states through a “hub” system. This requirement, however, 
would impose significant costs, creates substantial privacy concerns, and has contributed 
to the enactment of state laws prohibiting compliance with REAL ID. 

• Verification of Social Security Information - PASS ID retains the REAL ID 
requirement to verify applicants’ social security information with the federal government 
through the SSOLV database. 
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• Official Purpose - PASS ID clarifies the official purpose of REAL ID to make clear that 
an individual who does not present a compliant DL/ID at the airport may not be denied 
boarding a commercial aircraft solely due to the failure to present a compliant DL/ID. 
DHS has previously acknowledged that this would be the case under REAL ID. 

Of the 18 benchmarks, PASS ID would eliminate two requirements that are not workable or that 
do not contribute to enhancing the security of DL/IDs. These are the requirements to commit to 
be in full compliance by May 2011 and to mark non-compliant DL/IDs as non-compliant. As 
discussed above, the deadlines under REAL ID are not workable. Therefore, PASS ID would 
replace the current timetable for compliance with one that states can actually implement. With 
respect to the requirement to mark non-compliant licenses as non-compliant, this is an 
unnecessary requirement of REAL ID that does not contribute to security. If a DL/ID does not 
contain the required marking to show that it is compliant, the DL/ID is, by default, not 
compliant. 

Conclusion 

REAL ID is broken and the uncertainty of its future leaves us all less secure. PASS ID would 
better protect safety and security by enhancing the integrity of all DL/IDs. PASS ID would not 
only enhance security, but it would do so at lower cost, with better privacy protections, and in 
greater coordination with key stakeholders. 

On behalf of the nation’s governors, I strongly urge your support for the PASS ID Act and urge 
the Committee to favorably report this legislation to the Senate as expeditiously as possible. 
While many states are moving forward in meeting the 18 benchmarks, full compliance with 
REAL ID will be difficult, if not impossible. As a critical deadline approaches at the end of this 
year, there is a great deal of uncertainty about the path forward. PASS ID will provide certainty 
and build upon the progress made to date. 

Thank you for the opportunity to testify today. 1 am happy to answer any questions. 
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18 Benchmarks 


BENCHMARK 

NUMBER 

BENCHMARK REQUIREMENTS 

REAL ID PASS ID 

NOTES 

1 

Mandatory facial image capture which state 
must retain 

✓ 

✓ 

Clarifies image can be 
captured when 
application is 
submitted. Allows 
electronic or hard 
copy storage of 
source documents 

2 

Applicant must sign a declaration under 
penalty of perjury that the infonnation 
presented is true and correct 


✓ 

No change 

3 

Applicant must present at least one of a 
finite list of source documents when 
estabiishinq identity 


✓ 

No change 

4 

Require documentation of: 

• Date of birth 

• Social Security Number 

• Address of principal residence 

• Evidence of lawful status 



No change 

5 

State must have a documented exceptions 
process 

■/ 

✓ 

Move from regulations 
to statute 

6 

Make reasonable efforts to ensure that the 
applicant does not have more than one DL 
or ID 


✓ 

Change to reflect the 
use of best practices 
and the elimination of 
requirement to utilize 
a new driver's license 
"hub" database 

7 

Verify lawful status through SAVE 

■/ 

/ 

No change 

8 

Verify Social Security account numbers 
through SSOLV 


✓ 

No change 

9 

Issue DL and IDs that contain integrated 
security features 


✓ 

Change to conform to 
regulations 

10 

Surface of cards must include basic 
information regarding the cardholder 


✓ 

Change "full legal 
name" to "legal 
name"; move 
exceptions process for 
inclusion of address of 
principal residence on 
the card from 
regulations to statute 

11 

Mark fully compliant OL and IDs with a 
DHS-approved security marking 


✓ 

Change to conform to 
regulations 

12 

Issue temporary or limited-term licenses to 
all individuals with temporary lawful status 
and tie license validity to the end of lawful 
status 


✓ 

No change 

13 

Have a documented security plan for DMV 
operations 


✓ 

Change to conform to 
regulations 

14 

Have protections in place to ensure the 
security of personally identifiable 
information 



Strengthened 

15 

Fraudulent document recognition training 
and security awareness for DMV employees 

•/ 

✓ 

No change 
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BENCHMARK 

NUMBER 

BENCHMARK REQUIREMENTS 

REAL ID 

PASS ID 

NOTES 

16 

Background checks for employees with 
access to personally identifiable information 


■/ 

No change 

17 

Commit to be in full compliance with 

Subparts A through D on or before May 11, 
2011 


X 

Require states to 
begin issuing 
compliant DL/IDs one 
year after final 
regulations and to 
complete enrollment 
five years after that. 
Puts full 

implementation on 
track for 2016, as 
opposed to December 
2017 under REAL ID 

18 

Clearly state on the face of non-compHant 
DLs or IDs that the card is not acceptable 
for official purposes, except for licenses 
renewed or reissued under 6 37.27 


X 

Require marking on 
compliant DiyiDs only 
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Hearing on "Identification Security: Reevaluating the REAL ID Act" 

July 15, 2009 


On behalf of the Center for Democracy and Technology (CDT), thank you for the opportunity to 
participate in this hearing on Identification Security and S. 1261, the PASS ID Act. 

CDT is a nonprofit, public interest organization dedicated to keeping the Internet open, innovative 
and free. CDT has been a leader in the policy debates over privacy issues raised by government 
identification programs. In particular, CDT has argued that Congress should amend the REAL ID 
Act to address key privacy flaws in the program and promote stronger privacy protections in state 
ID initiatives that threaten privacy and security separate and apart from the mandates of REAL ID. 

CDT applauds the Committee for revisiting the REAL ID Act and commends Senators Akaka and 
Voinovich for initiating a dialogue on how identification security can be improved in a privacy- 
protective way. Our testimony will begin with some observations about the privacy issues 
associated with government identification programs and will describe how REAL ID exacerbated 
these privacy concerns. We will then offer CDT’s analysis of the PASS ID Act. We will close with 
some suggestions for how Congress might strengthen the bill. 


CDT has long .supported the goal of making driver's license issuance more 
secure. The 9/11 Commission drew attention to crucial security gaps associated 
with the issuance of driver's licenses and ID cards. However, starting even 
before 9/11, but spurred by these findings, states have been moving towards 
greater standardization of driver's license design and greater centralization of 
personai data in Department of Motor Vehicle (DMV) databases, and those 
efforts will likely continue regardless of what Congress does. Three key trends 
in state driver's license programs pose serious privacy concerns for the 240 
million Americans and lawful residents who carry government-issued 
identification credentials: 
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1) Driver's licenses and ID cards are being designed with standardized 
machine-readable zones (MRZs), and these features are being 
implemented in unprotected and interoperable ways, 

2) Because information contained on cards is unprotected and the 
technologies are interoperable, information in the MRZ can be read, 
stored, and re-used by commercial and governmental entities with few 
limitations, facilitating intrusive tracking and profiling. 

3) ID card systems increasingly include a centralized back-end information 
component containing vast amounts of identity data, vulnerable to theft 
and internal abuse if not properly protected. 

REAL ID failed to address the concerns raised by these trends. In fact, the Act 
and final rule created new privacy and security risks while exacerbating old 
ones. If REAL ID were to go forward, it would: 

• Create a de facto national ID system with a serious risk of mission creep. 
If fully implemented, the program presents the very real possibility that 
individuals would not be able to function in American society without a 
REAL ID card, 

• Centralize vast amounts of sensitive, personally identifiable information 
(PII) through the creation of a centralized ID database. Such a database 
would create a valuable treasure trove of identity data, vulnerable to 
identity thieves, hackers, and internal abuse. 

• Mandate a standardized MRZ on all REAL ID cards without requiring 
protections against skimming, which will facilitate intrusive tracking by 
unauthorized governmental and private entities. 

• Fail to adopt meaningful privacy and security standards for the 
protection of personal information in the REAL ID system. 

The REAL ID Act is not the only troublesome ID card program. In a related 
initiative, the Department of Homeland Security (DHS) is creating enhanced 
driver's licenses with imbedded, insecure RFID chips (so-called "vicinity-read" 
RFID) that will threaten the personal privacy and security of many American 
citizens living and working along our borders. The State Department's passport 
card also incorporates these insecure RFID chips. 
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The approach proposed in the PASS ID Act, S. 1261, mitigates many of the major 
privacy risks that REAL ID created while still imposing minimum standards for 
driver's license issuance. Most notably, the PASS ID Act: 

• Eliminates the requirement under REAL ID that states give all other 
states "electronic access" to personal information in DMV databases, 
thus taking away one impetus for further centralization of identity data. 

• Removes from DHS's authority the ability to unilaterally determine new 
official purposes for which a PASS ID-compliant card can be required, 
mitigating (though not eliminating) the potential for mission creep. 

• Requires that states adopt privacy and security safeguards for personally 
identifiable information contained in DMV databases. 

• Provides some protections for persona! information stored in the MRZ 
by limiting the storage, use, and re-disclosure of that information by 
unauthorized third parties. 

The new bill incorporates nearly all of the substantial privacy protections from 
the REAL ID repeal bill that CDT supported in front of this committee in the 
noth Congress and a few more. CDT urges Congress to ensure that these 
provisions are not weakened. 

While PASS ID is a major improvement over current law, the bill should be 
strengthened to further protect privacy and civil liberties while still achieving 
security objectives. PASS ID provides the opportunity to establish privacy 
guidance and protections for features of the state driver's license system that 
will exist regardless of REAL ID. Specifically, PASS ID could be further 
strengthened by: 

• Mandating encryption or other security features to protect against 
unauthorized scanning of information in the licenses' MRZ. 

• Limiting the data elements that may be contained on the MRZ to only 
what is necessary for legitimate law enforcement or DMV administrative 
purposes. (This could be accomplished by amending § 242(b)(9) in the 
proposed Title II, Subtitle E of the Homeland Security Act.) 

• Reject the use of "vicinity-read" RIFD technologies (now incorporated in 
enhanced driver's licenses) in PASS ID cards. (This could be 
accomplished by amending § 242(a)(4) in the proposed Title II, Subtitle E 
of the Homeland Security Act.) 
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• Require encryption to protect any PII transmitted electronically for PASS 
ID compliance purposes. (This could be achieved in Sec. 5(b)(2) of the 
PASS ID Act.) 

• Remove or substantially shorten the retention requirement for physical 
or electronic copies of source documents. (This could be addressed in § 
242(d)(1) in the proposed Title II, Subtitle E of the Homeland Security 
Act.) 

CDT looks forward to working with Congress to make these and other 
improvements to the PASS ID Act as the bill moves forward. 


S Government Identification Programs Raise Privacy 
Concerns 


In recent years, the federal government has launched a variety of ID card 
programs, with the goal of making government-issued cards more reliable as 
identity credentials and to address the security gaps identified by the 9/11 
Commission. Alongside these initiatives, states have been redesigning their 
driver's license systems to incorporate a number of advanced technology 
features. 

While the goal of increasing security in the issuance of driver's licenses and ID 
cards is an important one, it should not be pursued without addressing the 
critical privacy and security risks posed by the technology features and back- 
end information systems that these ID programs are beginning to incorporate. 
Three key trends in ID card development threaten the civil liberties of the 240 
million Americans and lawful residents who hold government-issued identity 
credentials: 

1) Driver's licenses and ID cards are being designed with standardized 
machine-readable zones (MRZs), and these features are being 
implemented in unprotected and interoperable ways; 

2) Because the information on the cards is not protected against skimming 
and the technologies are interoperable, the cards can be read by 
unauthorized commercial and governmental entities and the electronic 
data they contain can be stored and redisclosed, facilitating intrusive 
tracking and profiling; and 
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3) ID card systems increasingly include a centralized back-end information 
component containing vast amounts of sensitive, personally identifiable 
information (PII), which attracts motivated hackers and identity thieves 
and facilitates internal abuse if not properly protected. 

The irony is that many technologies aimed at providing more secure licenses or 
more efficient licensing can actually threaten both security and privacy if not 
properly designed and implemented. CDT has reported on examples of these 
cases in the past and it is important to recognize that these threats to individual 
Americans continue to occur frequently.* Many recent cases of internal abuse 
and data theft underscore yet again the need for minimum standards to protect 
against unauthorized use and disclosure of sensitive PII collected and 
maintained at state DMVs; 

• North Carolina — Thieves stole a computer containing records from a 
DMV office, including Social Security numbers, birth dates, and driver's 
license numbers. The DMV believes that the theft's purpose was to make 
counterfeit licenses. The DMV took three weeks to notify the 16,000 
people affected by the breach.^ 

• California - Five former DMV employees were found guilty in a fake ID 
scheme, issuing fraudulent driver's licenses and identification cards 
between November 2003 and July 2005 for bribes. People paid $1,000 to 
$1,500 per license.^ 

• Colorado - Security flaws were found that could affect all 3.4 million 
active DMV records. The State Auditor discovered that the DMV "sends 
large batches of personal information over the Internet without 
encryption" (in clear text). In addition, the DMV did not reset database 
permissions properly, and up to 33 former employees were still able to 
access the Driver's License Information System database (some for over 
one year after their departure). Accessible information included names, 
addresses, dates of birth, and Social Security numbers.'* 


1 Center for Democracy & Technology, "Unlicensed Fraud; How bribery and lax security at state motor 
vehicle offices nationwide lead to identity theft and illegal driver's licenses" {January 2004), available at 
b»p:/f\vwv\.cdt.orj2.-'privaLv/20()4(t20UJtTiv.pdt '. 

2 Associated Press, "Thieves take N.C. DMV computer with personal info," WCNC, September 28, 2006. 


3 Henry K. Lee, "Former DMV worker sentenced to 366 days in ID scam," San Francisco Chronicle, April 
30, 2007. 

4 Jessica Fender, "DMV puts Coloradans at risk of ID theft," Denver Post, July 9, 2008. 

5 


VerDate Nov 24 2008 


09:40 Jun 06, 2011 


Jkt 51792 


PO 00000 Frm 000135 Fmt 06601 


Sfmt 06601 


P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



132 


• Washington, D.C. - A former DMV employee was found guilty of 
issuing around 200 licenses to individuals who did not live in the district 
or were not U.S. citizens. People were charged $1,000 to $1,700 per 
license.^ 

• Massachusetts -- A Registry of Motor Vehicles employee was arrested for 
issuing driver's licenses to undocumented workers for $1,000 each. The 
employee is accused of creating licenses with Social Security cards and 
birth certificates that belonged to people other than the ones she issued 
licenses to.^ 

These incidents make it clear that the computerization and centralization of 
driver's license data creates risks to both security and privacy. The addition to 
cards of advanced features such as an MRZ does not necessarily produce more 
secure or reliable cards, especially if the back-end databases and other 
procedures are insecure. Congress should be concerned about these types of 
incidents, not only for national security purposes but also because such abuses 
place everyday Americans at increased risk of identity theft and intrusive 
tracking by third parties. These incidents demonstrate the need for stronger 
minimum standards for card issuance and privacy protections for associated 
identity information to ensure that privacy and security risks are not aggravated 
in the process of trying to improve driver's license and ID card Issuance. 


B REAL ID and Related Initiatives Exacerbate Privacy and 
Security Risks 


REAL ID (as defined by the REAL ID Act and DHS's final rule) and the related 
enhanced driver's license (EDL) and passport card initiatives exemplify 
problematic trends in government identity programs. In fact, these programs 
have been implemented in a way that exacerbates the privacy and security 
concerns, defeating many of their professed security objectives. 

REAL ID 

Following the 2001 terrorist attacks, the 9/11 Commission Report underscored 
the need for minimum federal standards for issuance of driver's licenses and ID 


5 Timothy Warren, "DMV worker gets time in prison; Paid to issue fake licenses," Washington Times, 
August 15, 2008. 

6 Eric Moskowitz, "Registry worker charged in bribe licensing scheme," Boston Globe, March 20, 2009. 
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cards. To implement the Commission's recommendation, the Intelligence 
Reform and Terrorism Prevention Act (IRTPA) of 2004 established a negotiated 
rulemaking process to craft such standards. However, before that process could 
bear fruit. Congress passed the REAL ID Act of 2005. Added as a rider to a war 
and tsunami relief appropriations bill, the REAL ID Act was passed with little 
debate or input from key stakeholders, including privacy advocates. 

More importantly, the REAL ID approach presented critical privacy and 
security risks. If implemented, the REAL ID Act would:^ 

• Create a de facto national ID system with a serious risk of mission 
creep: The REAL ID Act and final rule would create a de facto national ID 
system for the 240 million Americans and lawful residents who carry 
state-issued driver's licenses or ID cards. Neither the Act nor the 
accompanying regulations placed any limits on the permissible uses of 
the REAL ID card, giving unfettered discretion to DHS to expand the 
"official purposes" for which REAL ID cards could be required, thus 
creating a serious risk of "mission creep." If merchants and other third 
parties are free to ask for the card and collect data from it, there is a very 
real possibility that individuals would not be able to function in 
American society without a REAL ID card. 

• Create a centralized ID database: The Bush Administration adamantly 
denied it, but REAL ID would likely result in the creation of a central ID 
database (or system of databases) by, among other things, requiring that 
states "provide electronic access" to all other states to information 
contained in motor vehicle databases. Intended to support the goal of 
"one driver, one license," such a centralized repository of identity 
information would be both unnecessary and especially vulnerable to 
hackers, identity thieves, and internal abuse, 

• Incorporate no meaningful privacy protections: REAL ID adopted no 
meaningful privacy and security standards for the protection of personal 
information stored in the REAL ID system. The Act itself doesn't require 
any privacy or security safeguards for information collected and stored 
pursuant to the program. While DHS's regulations required that states 
develop a privacy policy and adopt reasonable safeguards to protect PII, 
the regulations did not provide any specific benchmarks against which 
DHS could assess states' compliance. 


7 Center tor Democracy & Technology, "Three Years I.aten A Primer on REAL ID" (August 2008), 
http;/ /www.cdf.org/ publications/policyposts/2008/13. 
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• Mandate a standardized, unprotected MRZ: Finally, REAL ID 
mandated a standardized MRZ, with no requirement of encryption and 
no limits on the data elements it could contain. In addition, there are no 
limits on who can scan the MRZ, collect personal information, and 
record the cardholder's activities. The lack of security and privacy 
safeguards for the MRZ would facilitate intrusive tracking and profiling 
by both private third parties and unauthorized government entities. 

At heart, not only would various mandates in the program be ineffective at 
making ID card and license issuance more secure, REAL ID created new privacy 
and security risks while exacerbating existing ones, CDT concluded that the 
REAL ID Act was so fundamentally flawed that changing DHS's regulations 
alone would be insufficient to address the serious risks posed,* 

Recognizing the unfunded (and high) costs of the program and its impact on 
privacy and civil liberties, the states responded negatively to REAL ID, ranging 
from outright rejection of implementation to legislative resolutions expressing 
disapproval. The Bush Administration delayed implementation of the program, 
essentially passing to this Congress and the new Administration the question of 
how to proceed. 

Enhanced Driver's Licenses and Passport Cards 

REAL ID is not the only problematic ID card program. In a related initiative, 
several states are currently issuing enhanced driver's licenses (EDLs) with 
imbedded, insecure RFID chips as part of the Western Hemisphere Travel 
Initiative (WHTI). The long range (so-called "vicinity-read") RFID chip that 
DHS chose for this initiative is highly insecure. The technology was designed for 
tracking inventory, not people, and can consequently be read from a 
considerable distance by third parties using standardized and widely available 
equipment. The State Department's passport card also incorporates these 
insecure RFID chips. 

When used for human identification, long range or vicinity-read RFID poses 
serious threats to personal privacy and security: it reduces user notice and 
control over when information is collected from the card and enables location 
tracking of the cardholder because the unique identifier stored on the chip can 
be easily skimmed (if unencrypted). These serious risks make such long range 


8 Center for Democracy & Technology, "REAL ID: What Should Congress Do Now? CDT Analysis of the 
REAL ID Act and the Department of Homeland Security's Final Regulations" (Feb 2008}, 
http:// www.cdt.org/ security/identity/20080201_REAL_fD_hillbrief.pdf. 
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RFID technology inappropriate for human identification and far outweigh the 
justifications asserted for its use in the EDL and passport card initiatives^ 


H The PASS ID Act [S. 1261] Mitigates Major Privacy Issues 
REAL ID Raises 


The Providing for Additional Security in States' Identification (PASS ID) Act [S. 
1261] mitigates key privacy and security flaws in the REAL ID program. The 
approach the Act proposes will increase the reliability of driver's licenses and ID 
cards in a way that better protects privacy and civil liberties. CDT supports the 
adoption of the PASS ID Act as a much-needed improvement over current law. 

Most notably, the PASS ID Act: 

• Removes the requirement that states "provide electronic access" to all 
other states to information contained in motor vehicle databases. 
Instead, to ensure "one driver, one license," the Act takes a much less 
onerous and less privacy invasive approach, requiring states to 
"[e]stablish an effective procedure to confirm" that a person applying for 
a compliant license or ID card is terminating or has terminated any other 
compliant license or card issued by another state. This change takes 
away one impetus for further centralization of identity data. [Sec. 3 - 
§242(d)(5)] 

• Removes from DHS's independent authority the ability to determine 
new "official purposes" for which a compliant ID can be required. 
PASS ID would require compliant cards for three specified official 
purposes and removes from DHS's authority the ability to unilaterally 
determine additional purposes (as REAL ID allowed). This change 
mitigates (though does not eliminate) the risk of mission creep. [Sec. 3 - 
§241(4)1 

• Requires privacy and security protections for PII in back-end systems. 
The PASS ID Act requires states to establish administrative and physical 
safeguards to protect the PII collected and maintained for license and ID 
card issuance. The Act also specifies that states must have procedures to 
prevent unauthorized access to and use of PII; give public notice of 


9 Center for Democracy & Technology, CDT Testimony on "The Impact of implementation: A Review of 
the REAL ID Act and the Western Hemisphere Travel Initiative" (April 2008), available at 
http: / / www.cdt.org / testimony / 20080429scope-written.pdf. 
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security and privacy policies; and establish a process for cardholders to 
access and correct their own PII. [Sec. 3 - §242(d){7)] 

• Provides protections for personal information on the MRZ. While the 
PASS ID Act still mandates the use of an MRZ, it prohibits the inclusion 
of the cardholder's Social Security number in the zone [Sec, 3 - 
§242(b)(9)] and places limits on the storage, use, and redisclosure of 
information contained in the MRZ. [Sec. 4] 

In addition, the PASS ID Act would establish a State-to-State One Driver, One 
License demonstration project to evaluate the feasibility of establishing an 
electronic system to prevent an individual from obtaining more than one PASS 
ID-compliant driver's license or ID card at any one time. [Sec, 3 - §245] The 
project would include a review of the appropriate governance structures that 
will be necessary to prevent unauthorized use of PII in the system and to ensure 
its security and confidentiality. 


S Privacy Protections Could be Further Strengthened in PASS 
ID 


while the PASS Act does not address all flaws in the REAL ID program, merely 
repealing REAL ID does not address all of the underlying privacy and security 
risks posed by government identification programs. PASS ID provides the 
opportunity to start building privacy guidance and protections into all state 
identification programs, addressing trends and issues that will exist regardless 
of REAL ID implementation. 

There are a number of ways in which the PASS ID bill could be further 
strengthened to protect privacy and civil liberties, while still achieving security 
objectives. Specifically, CDT urges Congress to: 

• Repeal the mandate for a standardized MRZ. Congress probably should 
not prohibit the trend towards inclusion of MRZs on state driver's 
licenses, but it should not be promoting this trend either. States should 
have the ability to consider and reject the use of MRZs if they determine 
the risks to privacy and security outweigh the benefits to their citizens. 

• To the extent that states wish to include an MRZ, mandate encryption or 
other security features for the MRZ so that data cannot be read or used 
for unauthorized purposes. 
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• Limit the data elements that may be contained on the MRZ to only what 
is necessary for legitimate law enforcement or DMV administrative 
purposes.'® The less information contained in the MRZ, the less attractive 
skimming will be to unauthorized third parties. 

• Reject the use of "vicinity-read" RFID technologies (now incorporated in 
EDLs and passport cards) in PASS ID-compliant driver's licenses and ID 
cards.” 

• Require encryption to protect any PII transmitted electronically for PASS 
ID compliance.'^ 

• Remove or substantially shorten the retention requirement for physical 
or electronic copies of source documents.'® Central retention of such 
sensitive documents creates a treasure trove of information that would 
attract identity thieves and facilitate internal fraud. 

Finally, Congress should strengthen privacy protections for all Americans and 
lawful residents who carry government-issued identity credentials, regardless of 
PASS ID implementation, by shoring up the Driver's Privacy Protection Act 
(DPP A). The DPPA is the main federal law protecting personal data in state 
DMV databases from disclosure to third parties. However, the DPPA contains a 
myriad of exceptions that virtually swallow the rule against disclosure of such 
data. Congress should amend the DPPA to protect against both governmental 
and commercial abuse of information by closing the loopholes it currently 
contains. 

Congress should also directly address the privacy risks associated with state 
trends towards outsourcing management of personal information to private 
entities such as the American Association of Motor Vehicle Administrators 
(AAMVA). Congress should amend the DPPA to clearly extend application of 
protections to information systems managed by private, non-govemmental 
entities to ensure uniform protection for all driver's license information. 


10 This could be accomplished by amending g 242(b)(9) in the proposed Title 11, Subtitle E of the Homeland 
Security Act. 

11 This could be accomplished by amending § 242(a)(4) in the proposed Title il, Subtitle E of the Homeland 
Security Act. 


12 This could be achieved in Sec. 5(b)(2) of the PASS ID Act 

13 This could be addressed in § 242(d)(1) in the proposed Title II, Subtitle E of the Homeland Security Act. 
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E3 Conclusion 


Protecting privacy and security in identification programs is an ongoing process 
that requires continual attention to new risks, including the potential for third 
party profiling and fraud. The PASS ID Act would be a notable improvement 
over current law and provides an opportunity to start building in privacy 
guidance to address privacy and security risks that exist apart from REAL ID. 
The new bill incorporates nearly all of the substantial privacy protections from 
the REAL ID repeal bill that CDT supported in front of this committee in the 
noth Congress and a few more. Most importantly, PASS ID: 1) removes the 
requirement that states provide electronic database access to other states; 2) 
takes away DHS's unilateral, independent authority to determine new purposes 
for a compliant ID; 3) requires privacy and security safeguards for information 
in back-end databases; and 4) imposes prohibitions on skimming and use of 
MR2 data. 

CDT urges the Committee to ensure that these provisions are not weakened. We 
stand ready to work with Members of the Committee to improve privacy and 
security in driver's license and ID card issuance and in associated back-end 
information systems. Thank you again for the opportunity to testify. 
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STirHEkllB 



SllCompoign org 


The 5-11 Campaign 
100 E. 51st St. , #7 Austin, TX 78751 
(512) 687-4069 

United States Senate 

Committee on Homeland Security & Governmental Affairs 
Washington, DC 20510 


ATTN; Trina Tryer 

RE: Entry for Public Record on the Reevaluation of Real ID & Consideration of the 
PASS Act 


To the Honorable Members of the 111th Congress & DHS Senate Committee; 

On July 1 5th, the Department of Homeland Security Senate Committee “re-evaluated 
the Real ID Act” and created an exploratory panel for the PASS Act, a substitution for 
the Real ID Act. We would like to add our observations and concerns about both Real 
ID and the PASS Act for the benefit of public record. 

We begin by recognizing PASS Act regulations that are well intended enough to not be 
considered obstacles or setbacks to personal liberty by our organization, The 5-11 
Campaign. We are not opposed to creating tamper resistant licenses, a uniform federal 
standard to supply accurate documents to license administrators to substantiate identity, 
or the intent to stop terrorism in our nation. These are in fact good policies that can add 
improvement to organize American life. 

The 5-11 Campaign, however, does not ignore the PASS Act as a path to continue 
policies of identity surveillance present in the Real ID Act. All 50 States were needed to 
move fon/vard with the plans for Real ID. We understand the PASS Act to simply be the 
rebranding of the Real ID Act. It's regulations are modified so it can continue to move 
forward over State laws established to stop national ID policy in 25 States, who 
opposed the Real ID Act. The PASS Act, if moved fonward would allow Real ID 
regulations and policies to continue, including regulatory unfunded mandates for RFID 
and biometrics technologies to all 50 states, with special emphasis on border states. 

We are particularly wary of the DHS Senate Committee overlooking the 11 states who 
passed resolutions against the Real ID Act, and 2 of 1 5 states who have passed laws 
against the Real ID implementation. It has only acknowledged 1 3 of these states 
publicly during the hearing. 7 other states introduced legislation opposed to Real ID this 
year were: Connecticut- Senator Joe Lieberman’s home state, Iowa, Rep. James 
Sensenbrenner’s state of Wisconsin, and Texas, home to both Rep. Lamar Smith and 
Rep. Ron Paul - at strong opposite ends of advocating the issue from within the same 
party. 


1 


VerDate Nov 24 2008 


09:40 Jun 06, 2011 


Jkt 51792 


PO 00000 Frm 000143 Fmt 06601 


Sfmt 06601 


P:\DOCS\51792.TXT SAFFAIRS PsN: PAT 



140 


STOP OEM. IB 



51lCcfnpa!gn.org 


The 5-11 Campaign 
100 E. 51st St. , #7 Austin, TX 78751 
(512) 687-4069 

The excesses of political failure attached to a Bush Administration are earmarked in the 
Real ID legislation. It is clear to all involved, that there is an opportunity to create better 
standards for identity today. The American person is ill served in terms of security and 
scope of practicality in both the PASS Act and in the Real ID Act. 

The potential for public-private collusion with local fusion centers over the sale and 
dissemination of information gathered by “machine readable zone technologies” without 
the consent of cardholders creates great risk for the betrayal of public trust. RFID & 
biometrics have a well documented history that they are insecure, conspicuous to 
identity predators, and therefore inappropriate for government sanctioned identity. This 
is not the whole of our concerns. 

We reflect and uphold the standard concerns of the following organizations: the CATO 
Institute, the ACLU, the Electronic Privacy Information Center, the Electronic Frontier 
Foundation, ALIAS, The No Border Wall Coalition, The Center for Constitutional Rights, 
Downsize DC. This may extend to most any other organization whose pre-existing 
concerns against the Real ID Act were not satisfied by the privacy, personal liberty, 
human rights, immigration considerations and changes presented in the PASS Act. 

To encourage legislators, who are now held to a standard consistent with 
recommendations in the 9-11 Commission report, you have time to create “a better 
mousetrap”. In 2001 , there was no law that required you to have identity to fly. 

Travellers provided identity as a commercial concession to airlines. It has become our 
misfortune that American identity has become a misplaced focal point for sussing out 
terrorists, who would evade regulatory conventions. Identity fraud evolves accordingly. 

I believe a more forthwith interpretation of the 9-11 Commission Report is in order. 

Most legislators could afford reason to hit a “reset” button on the matter and start afresh 
on other salient recommendations. Everyone deserves a second chance at this, 
especially the American people. 

Identity is personal. There isn’t a separate identity standard for national leaders and the 
American public. Everyone uses licenses and ID cards to operate in the tasks of daily 
living. Critics of the Real ID and the PASS Act criticize the scope of how a national 
identity plan affects the individual citizen, as well as the aspiring immigrant, it is 
unnecessary for us to sustain an identity system that would eventually lead to a societal 
dynamic which criminalizes citizens for lack of identity. 
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STOP SEAL ID 



SDCantpolsnorg 


The 5-11 Campaign 
100 E. 51st St. . #7 Austin, TX 78751 
(512) 687-4069 

In our research we found influences outside of domestic governance had a hand in 
creating the Real ID program. DHS has adopted international policy drafted in the 
Western Hemisphere Travel Initiative. This may explain the nature of how a plan for 
U.S. national identity evaded by a populist debate and the robust scrutiny of the U.S. 
Congress. Other international and UN think tanks were involved in the plan to 
incorporate national-to-international identity with fluidity over terms of immigration. We 
find fault with the plan for a North American Community, as many do over the span of 
this continent. We have had no forum to dispute our involvement and what is required 
from us as individuals to move any such plan fonward. Unfortunately, resistance to this 
agenda has found its way to you. You need our consent, volition, involvement, and our 
money to to fulfill this plan; which you are simply not seeing from the American people. 

We believe part of the reason is based on the consultancy you contracted for purposes 
of evaluating and creating a national identity program by Homeland Security. DHS’ 
contract with Marcus Wolf, former East German stale intelligence directorate (STASI), 
provided “keys to the kingdom” for totalitarian governance. Policy based on the privacy 
ethics of a closed society in the 1950's known tor it’s oppressive surveillance of 
personal identity, contradicts elected officials oath of office to protect and defend the 
U.S. Constitution. Additionally, subordinating the quality of American life, by our 
standards, to the passive-aggressive strategies of Israeli protectionism is, harsh, 
excessive and inappropriate. Israel’s policy to use pre-emptive criminal evaluation and 
to incorporate prolific checkpoints in society creates hostility where there is none. 

I encourage those evaluating American defense and national security to call in other 
nations who have little to no terrorist threats hanging overhead and observe what they 
have done right to deter terrorism. We believe this is just one alternative to 
perpetuating a standard to continually and fearfully stave off middle-eastern blowback to 
the point where Americans must sacrifice their identity in unnecessary and costly 
dramas every day. We deserve to move on from the events of 9-1 1 . 

Please repeal the Real ID Act. Accompanying this letter is a model of repeal legislation 
for working ideas on what we feel is the best approach to start afresh, creating more 
secure standards for American identity while abandoning the extreme direction both 
PASS ID and Real ID would take U.S. identity. This is an opportunity for Statesmen, 
workhorses and capitulators alike. We welcome the changes to come. 
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STfiPSEMii 



S'lCompalgti.orj 


The 5-11 Campaign 
100 E. 51st St. , #7 Austin, TX 78751 
(512) 687-4069 


We ask you to : 

• Vote NO on the PASS Act 

• Adopt legislation to repeal Real ID and to continue to consider other legislations to 
replace Real ID 

• Suspend implementation of the Real ID based on a rule or Judgement, until a better 
law is available 

• Freeze budget allocations to State governments to implement Real ID regulations 

• Provide a forum for a comprehensive debate over National identity & Immigration, to 
the event of decoupling the issues 

• Afford yourselves a less drastic timeline for staggered, reachable goals based on 
priorities 

• Work with statesmen, civil liberty, technology, identity security and privacy advocates 
on future rule making processes 

• Creating a government accountability panel on identity matters for a nation as diverse 
as the United States 

Thank you for your service to the U.S. and to us. We know you are committed to the 

protection of this great nation. We look forward to working with those who agree and 

disagree with us for the benefits of long term progress. 

Respectful regards, 


Sheila Dean 
The 5-1 1 Campaign 
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PROPOSED REPEAL LEGISLATION of THE REAL ID ACT 

WHEREAS, The REAL ID Act of 2005 was enacted by the 
United States Congress as part of a broad supplemental 
appropriations package relating to homeland security 
issues, with no established debate; the Act requires all 50 
states to validate primary documents used to obtain a 
driver's license or identification card and to issue 
licenses and ID cards in a uniform, federally approved 
format if the licenses and cards are to be accepted as 
identity documents by the federal government; and 

WHEREAS, The total cost for the initial implementation 
of the new regulations has been estimated to be $9.9 
billion, though to date Congress has appropriated only a 
fraction for the effort; given the expense of the program 
and the minor Congressional contribution, the REAL ID Act 
is effectively an unfunded mandate, as federally approved 
identification is required for a United States citizen to 
board a commercial airplane, make transactions with a 
federally licensed financial institution, enter a federal 
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building, or apply for federally supported public 
assistance, such as Social Security; and 

WHEREAS, In addition to unease about expense, 
provisions of the REAL ID Act raise concerns about data 
security and possible identity theft; the Act requires 
statewide databases to be integrated and shared with the 
federal government, but does not establish clear security 
standards for the network nor designate an entity to 
control access to the system; and 

WHEREAS, The proposed rule making may be based on 
poorly enforced, established immigration policy, and 
obscured facts as 9-11 hijackers obtained VISAS and were 
present in the U.S. legally; and 

WHEREAS, The use of biometrics, RFID, and other 
regulated surveillance technologies have not proven 
effective for expediting traffic across U.S. borders, or 
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delivered consistent accuracy in proving bonafide identity 
of adopters of the technologies; and 

WHEREAS The U.S. people would suffer unreasonable 
search and seizure against the 4th Amendment according to 
Real ID mandates and regulations requiring one-to-many uses 
of biometrics, RFID microchips, and facial recognition 
technologies; and 

WHEREAS, These ambiguities in the legislation make it 
more likely that information about a driver ' s license or ID 
card holder could be illegally accessed through another 
state's less secure system, creating a vulnerability where 
none currently exists and increasing the likelihood of the 
very threat the program was designed to minimize; 
furthermore, some states' officials have pointed out that 
their computer systems are not even capable of verifying 
documentation as required by the Act; and 
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WHEREAS, The negative implications of the federal 
regulations are raising concerns nationwide, with 43 states 
currently considering legislation questioning, opposing, or 
refusing to carry out the requirements of the REAL ID Act; 
considering the obvious fiscal consequence to U.S. States 
and the considerable flaws inherent in the federal 
requirements, it is incumbent on U.S. States to act 
likewise; now, therefore, be it 

RESOLVED, That the 111th Congress of the U.S. States 
hereby comprehensively repeal the federal REAL ID Act of 
2005; and, be it further 

RESOLVED, That no replacement containing language of 
the Real ID Act remain as federal law in the United States 
of America. 
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U.S. SENATE COMMITTEE ON HOMELAND SECURITY 
AND GOVERNMENTAL AFFAIRS 

July 15,2009 

IDENTIFICA TION SECURITY: 
REEVALUATING THE REAL ID ACT 


STATEMENT FOR THE RECORD 


SUBMITTED JOINTLY BY: 

JANICE L. KEPHART 

National Security Policy Director, Center for Immigration Studies 

and 

JENA BAKER MCNEILL 

Policy Analyst, Homeland Security, Heritage Foundation 
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Identification Security: 
Reevaluating the REAL ID Act 

Janice L Kephart and Jena Baker McNeill 


Members of the Senate Committee on Homeland 
Security and Governmental Affairs introduced the 
Providing for Additional Security in States’ Identifi- 
cation (PASS ID) Act of 2009 on June 15, 2009 . This 
act would repeal substantive provisions of the REAL 
ID Act of 2005,* which aimed at ensuring that all 
states meet minimum security standards for issuing 
driver’s licenses in order to enhance national security, 
increase driver safety, combat drug running, and bet- 
ter safeguard against identity theft and fraud. 

While no state is compelled to comply, approxi- 
mately 30 states are actively moving to meet R^L ID’s 
minimum standards, which will help to make Amer- 
ica less vulnerable. Opponents of REAL ID have 
painted the law as an affront to privacy and states’ 
rights, but the reality is that REAL ID is an appropriate 
means for maintaining liberty and security. Congress 
should preserve REAL ID, fund it adequately, and lake 
steps to ensure its full implementation. 

A 9/11 Commission Recommendation 

REAL ID was enacted in 2005 in direct response to 
recommendations of the 9/11 Commission that the 
federal government set secure standards for identifi- 
cations, such as driver’s licenses. The commission 
found that 18 of the 19 hijackers on September 11, 
2001, obtained 17 driver’s licenses and 13 state IDs, 
including at least seven obtained by fraud in Virginia, 
Six of these IDs were used to help the hijackers board 
planes on the morning of 9/11.^ Of the legally 
obtained IDs, many were duplicates, with some states 
issuing the same hijacker multiple licenses over a 

mML 
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Talking Points 

• America has a need for more stringent driver's 
license security standards to enhance national 
security and driver safety, combat drug run- 
ning and better safeguard against identity 
theft. REAL ID is legislation, enacted in direct 
response to the 9/1 1 Commission recommen- 
dations, that meets these goals while main- 
taining privacy, safeguarding states' rights, 
and maintaining individual liberties. 

• PASS ID would repeal REAL ID outright, strip- 
ping away the substantive provisions that 
are already making driver's licenses more 
secure, including a repeal of 9/11 Commis- 
sion Identity verification recommendations. 
Information sharing between states, airport 
ID security standards, and a rollback of com- 
pliance deadlines. 

• Congress should preserve REAL ID, fund It 
adequately, and take steps to ensure Its full 
implementation by moving Interested states 
into the program, and allowing flexibility to 
the state grant program. 


Ttits paper, in its entirety, can be found at: 
mvw.h&itage.org/Res&3rch/HomelanaSecurfty/bg2288.(fin 

Produced by the Douglas and Sarah Allison 
Center for Foreign Policy Studies 
of the 

Kathryn and Shelby Cullom Davis 
Institute for International Studies 

Published by The Heritage Foundation 
214 Massachusetts Avenue, NE 
Washington. DC 20002-4999 
(202) 546-4400 • heritage.org 

Mottling written here is to be construed as necessarily reflect- 
ing the views of The Heritage Foundation or as an attempt 
to aid or hinder the passage of any bill before Congress. 
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period of several months. In its report, the 9/11 
Commission recommended: 

Secure identification should begin in the 
United States, The federal government 
should set standards for the issuance of 
birth certificates and sources of informa- 
tion, such as drivers licenses.^ 

Most of the REAL ID provisions were adopted 
from a secure ID framework drafted by the Ameri- 
can Association of Motor Vehicle Administrators 
(AAMVA) and published in a lengthy report in 
response to the 9/11 Commission’s investigation.'^ 
The standards emphasized that identity documents 
must be secure in their content, physical features, 
and issuance process. Without identity security at 
the base of identity document issuance processes, 
the AAMVA concluded that driver's license issuing 
standards would not produce secure licenses. 

The Need for Standards 

The need for more stringent standards dates back 
to before 9/11. Identity has always been the corner- 
stone of a free society, and for decades the key form 
of identification in the United States has been the 
driver’s license. In its 2004 Security Framework, the 
AAMVA identified clear security parameters: 

The license is now readily accepted as an 
official identification document for both 
licensed drivers, and, in most jurisdictions, 
for non-drivers. The Motor Vehicle Adminis- 
trations (MVAs) who issue these documents 


have unique, continuous and long-lasting 
contact with most of their constituents from 
the individual’s teenage years onward. 

Most MVAs allow driver’s license reciprocity 
with other MVAs; therefore a common secu- 
rity protocol among MVAs is necessary. 
This document provides minimum standards 
of security, interoperability and reciprocity 
agreed upon by all North American MVAs 
regarding driver’s license/identification card 
(DL/ID) issuance. Each MVA shall: 

• Either meet or exceed the requirements 
of the Security Framework based on risk 
analysis and resource availability. 

• Determine that all individuals granted a 
Dl/ID “are who they say they are.” 

• Ensure that each individual issued a DU 
ID “remains the same person’’ through- 
out subsequent dealings both with itself 
or any other MVA.^ 

Licenses have often been copied or manipulated 
and are subject to vast amounts of identity theft and 
fraud. For example, a woman in Florida pleaded 
guilty to obtaining a fake driver^ license in someone 
else’s name and using it to draw on the victim^ bank 
account and 10 obtain credit cards, charging about 
$4,000 on those cards.^ Driver’s license fraud rings 
have been prosecuted nationwide, including well- 
known cases in Michigan, Pennsylvania, New jersey, 
New York, and Ohio,^ The Casiorena Family Organi- 


1. Public Law 109-13, §§ 201-207, 

2 . Janice L. Kephan, "Idencity and Security: Moving Beyond the 9/ 1 1 Staff Report on identity Document Security,” 9/1 1 
Secunty Solutions, February 23, 2007, pp. 8-1 1 . at htip://www.91 hecuntysolutions.com/ 
index.php?option=‘Com_conieni&task=view&id=‘U7&kemid=38 (May 22. 2009, 

3. National Commission on Terrorist Attacks Upon the United Staie.s. The 9/1 1 Commission Report; Final Report of the 
National Commission on Terrorist Attacks Upon the United Slates (New York: WW Norton and Company, 2004), p. 390, 
at hiip://www.9-l lcommission.gov/reporl/9} IReport.pdJ (May 21, 2009). 

4. American Association of Motor Vehicle Administrators. “AAMVA DL/ID Security Framework." February 2004, at 
ht[p://www.aamva.org/aamva/DocumentDisplay.aspx?id~{25BBD457-FC4F-‘t852~A392-B91046252194l (May 26, 2009), 

5. Ibid,, p. 8. 

6. U.S. Department of justice, “Identity Theft and Identity Fraud." at http://www.usdoj.goy/cnminal/Jraud/wehsites/idthcft.himl 
(May 22, 2009), 

7. Kephan, “Identity and Security,” pp. iO-1 1; Janice L, Kephart, presentation at panel on "Making REAL ID Real: 
Implementing National Standards," The Ilenlage Foundation, audio file, January 16, 2008, at http://www.heritage.org/ 
press/even ts/evOl I608a.cfm; and Janice Kephan, “Ohio Drivers Licenses Hit by Four- Year ID Theft Scam," Center for 
Immigration Studies, December 17, 2008. at htip://cis.orgAtephart/OHDrivcrsLicense (May 26, 2009), 
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zation operated franchises in every major city in the 
United Stales for over a decade, reaping millions of 
dollars annually from counterfeited and stolen IDs.® 
To address the 9/1 1 Commission’s and AAMVi% 
recommendations and growing media attention on 
the issue of driver’s license fraud, Congress enacted 
the REAL ID Act in 2005. The act includes the fol- 
lowing compliance requirements; 

• Identity verification. Each drivers license or 
identity card will be required to contain a per- 
son’s full legal name, signature, date of birth, 
gender, driver’s license or identification number, 
photograph, and the address of the persons prin- 
cipal place of residence. 

• Document authentication. States are required 
to digitize birth records (another key 9/11 
Commission recommendation) and review the 
authenticity of the information provided to 
obtain a license, such as Social Security informa- 
tion, Immigration or lawful presence documen- 
tation, and other proof of identity, such as 
principal place of residence. 

• Card security. REAL ID requires a certain level 
of physical security features to ensure more 
tamper-proof cards. 

• Security plans. To ensure states meet security 
and privacy standards and to hold them account- 
able, REAL ID requires states to submit detailed 
security plans, 

• One driver, one license, REAL ID requires 
creation of a network of state databases to 
enable slates to verify that applicants do not 
hold multiple licenses in multiple states, some- 


thing states already do voluntarily for commer- 
cial licenses and “bad” drivers. They are also 
exchanging digital images of drivers outside of 
REAL ID requirements. 

• “Official purposes” requirement. REAL IDs 
will be required to board a commercial aircraft or 
enter a federal building and other areas deemed 
for “official purposes.”^ 

Concerns Mitigated 

Some controversy began soon after REAL ID was 
enacted. States were unhappy about paying to 
upgrade their licensing systems to meet the REAL ID 
standards.^® Privacy advocates feared the onset of a 
national identification card and creation of national 
databases. Even before the proposed regulations 
were released in 2008, state legislatures began to make 
assumptions about REAL ID, which led to significant 
misinformation about the program’s execution. 

By January 2008, when the Department of 
Homeland Security (DHS) rolled out the REAL ID 
regulations, the states’ substantive concerns had 
been assuaged. To ease their cost and logistical con- 
cerns. compliance times were extended to reduce the 
cost of issuing REAL ID licenses, Originally, REAL 
ID would have required slates to produce compliant 
IDs for all driver’s licenses — including new appli- 
cants, those renewing their licenses, and those sim- 
ply wanting to board a plane whose licenses would 
not expire until 2013. The DHS reduced this cost 
burden by including phase-in requirements that 
allow Slates to become compliant first with licenses 
of those under 50 years old by 2014 and then with 
those over 50 years old by 2017.^^ An internal DHS 


8. Kepharl, “Identity and Security," p, 9, See pressrelease, "Francisco Jarier Miranda-Espinosa Sentenced to Serve over 

1 1 Years in Federal Prison for Aggravated Identity Theft and Conspiracy to Launder Monetary InstTumenis.” U.S, Attorney’s 
Office, District of Colorado, February 15. 2006, at }\ttp://www.usdo}.govlusaoko/pre%^_rz\taiti/arch\\t/2006/¥tbruary06/ 
2_16_06.htTni (June 10. 2009), and press release, “Joint Task Forces Created In 10 Cuie.s to Combat Document and 
Benefit Fraud,” U.S, Department of Homeland Security. Immigration and Customs Enforcement, April 5, 2006, at 
htip://www.dh$.gov/xnews/releases/press^releaseJ)884.ihtm (May 26. 2009). 

9. Public Law, 2005 109-13, § 206. 

10. Wait Wiihams, "State Lawmakers Challenge REAL ID Act," The State Journal (Charleston, W Va.), January 24. 2008, at 
hUp://www.slatejournalcom/slory.cJm?func=‘viewslory&storyid=33938 (May 22. 2009). 

11. Eliot C. McLaughlin, "Federal ID Plan Raises Privacy Concerns." CNN. http://ww\vxnn.com/2007/POUTICS/08/}6/realid/ 
index.html (May 22, 2009). 

12. Anne Broache, "Homeland Security Proposes Delayed REAL !D Rollout," CNET News, January 11, 2008, at 
htlp://news.cnei.com/8301 -1 078^_3-98‘i8924-7.himl (May 22. 2009). 
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they may issue them. Nor does the law bind states to 
its provisions. Rather, REAL ID simply makes clear 
that noncomphant driver’s licenses and noncompli- 
ant state-issued ID cards cannot be used as identifi- 
cation for any federal purpose. In this way, REAL ID 
makes Americans safer and deals with several issues. 

Making Americans Safer. REAL ID fulfills a key 
9/11 Commission recommendation. The commis- 
sion^ recommendations have frequently received 
bipartisan support as important guidelines that 
should be implemented to help to prevent acts of 
terrorism against America. Congress has passed 
numerous bills to implement the 9/11 Commis- 
sion’s recommendations, including the Intelligence 
Reform and Terrorism Prevention Act of 2004^^ 
and Implementing the Recommendations of 9/11 
Commission Act of 2007.^^ 

The driver’s license provisions of the REAL ID 
law are no different. The 9/1 1 Commission recom- 
mended requiring all states to meet minimum secu- 
rity standards for issuance of and identification for 
driver’s licenses. Given that six hijackers had used 
fraudulently obtained Virginia IDs to board planes 
on the morning of 9/11, REAL ID went further by 
requiring REAL IDs (or secure equivalents) to board 
commercial aircraft or enter critical government 
facilities such as nuclear power plants. 


13. At a January 2008 press conference, DHS Secretary Michael Chertoff slated; “What we’re doing is we're taking the current 
cost estimate, which may— which is a pretty generous estimate, I might say — which is under $4 billion for a period of 10 
years nationwide. And if you were to extrapolate that over all the licenses, it would essentially, on a pro rata basis, come 
out to a cost of a little more than $8 per license.” Michael Chertoff, remarks at press conference, U.S, Department of 
Homeland Security, January 1, 2008, at ht(p://www.dhs.gov/xnews/speeche!:/sp^l200320940276.shtm (May 26, 2009). 

1 4. Janice Kephart, "Secretary Chertoff’s Stocking Siuffer: States Get Infusion of Secure ID Monies,” Center for Immigration 
Studies, December 19, 2008, at http://d$.org/kephan/chenoJjmockmgstujJeriM3iy 26. 2009). 

15. fhid, 

16. National Association for Public Health Statistics and Information Systems, presentation at June 2007 Annual Meeting, 

1 7. “EWE is popular in reducing fraud in Social Security and Medicare and Medicaid checks already. For example, EWE Pilot 
with 55A for August 2002 to December 2003 for Binh/Death Verifications/Certifications included participating Vital 
Records Offices in California, Colorado, Hawaii, Iowa. Minnesota. Mississippi, Missouri, Oklahoma and SSA Local Offices 
in 26 states had EWE access.” Rose Trasatn, ”All About EWE,” presentation at ISM Conference, Boston, August 6, 2007, 
at hup://www.aphsa-ism.org/ConJerence/Doc/2007%20l5M%20ConJerence%20Pres€mation%/5e%s\on%20l- 
3_Cilizenship%20Vcnfication_Trasalti.pdf (May 26, 2009). 

18. James Jay Carafano, "DHS Gets REAL ID Right,” Heritage Foundation VVebMemo No. 1801, February 7, 2008, at 
httpV/www. fienicige.org/Research/HomriandSecunty/wml80i. c/m. 

19. James Jay Carafano, "Making REAL ID a Reality — Concerns, Challenges. Choices, Solutions,” testimony before the 
Committee on the Judiciary, U.S. Senate, May 8, 2007, at http://www.hentage.org/Rcsearch/HomelandDejense/tsL050807.cfm. 

20. Public Law 108-458. 

21. Public Law 110-53. 


economic impact assessment of the new pha^-in 
deadlines concluded that implementing REAL ID 
would cost about $8 per person.^^ In addition, 
under the REAL ID grant program, about $149 mil- 
lion in appropriated funds was distributed in 2008 
to help stales to implement REAL ID.^'^ 

In an effort to implement the one-driver-one- 
license program, DHS designated Mississippi as the 
"lead hub” state, with Florida and Wisconsin as two 
partner states, and appropriated $ 1 7 million to help 
states begin meeting the information sharing and 
state-based database requirements of REAL ID.^^ In 
addition, Kentucky was awarded $3 million to pre- 
pare for the nationwide deployment of electronic 
birth record verification to support REAL ID iden- 
tity verification, otherwise known as Electronic Ver- 
ificalion of Vital Events (EWE).**’ To date, 13 states 
have digitized their birth records, and North 
Dakota. South Dakota, and Iowa have a verification 
network for checking driver's license applications.^^ 

The Benefits of REAL ID 

Given the ongoing debate, it is important to lay 
out what REAL ID actually is and is not. The basic 
premise of REAL ID is to set minimum standards for 
issuing driver’s licenses and IDs.^® It does not limit 
slates on how many IDs they can issue or to whom 
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Illegal Immigration. REAL ID permits states to 
issue drivers licenses and IDs to whomever they 
choose, but only those who can demonstrate that they 
are lawfully present in the United States may obtain 
REAL IDs. More specifically, REAL ID requires not 
only lawful presence, but also that the duration of 
the license or ID match the individual’s legal length 
of stay in the U.S. In other words, once a person is 
no longer lawfully present in the United States, 
their drivers license should expire. This provision 
is necessary to prevent individuals who enter the 
U.S. legally and overstay their visas from using 
their driver’s licenses or IDs to access federal areas 
with "official purposes.” This will prevent individuals 
illegally in the U.S. from using false driver’s licenses 
to obtain government services fraudulently.^^ 

Privacy. REAL ID requires those handling data- 
base information and producing IDs to undergo 
more rigorous background checks and screening 
than is currently required. Furthermore, facilities 
that create and store IDs are required to maintain a 
minimum level of physical security on their pre- 
mises, This means that information is better pro- 
tected, not less. Furthermore, REAL ID does not 
give information to the federal government, but 
instead ensures that states remain in charge of this 
information, in the same way that they did prior to 
REAL ID. In addition, states must submit certifica- 
tion plans and meet privacy standards to demon- 
strate that they comply with REAL ID standards. 

Fraud and Identity Theft. Billions of dollars are 
lost each year in identity theft, fraudulently 
obtained government services, and other criminal 
activities, Standards that take security for granted 
simply make no sense in the 21si century. Efforts to 
implement the 9/11 Commission’s recommenda- 
tions on identity verification, lawful presence, and 
the digitization of documents, such as birth and 


death records, have already substantially reduced 
fraud. Furthermore, those states that have not fully 
complied with REAL ID, such as Maryland, have felt 
the strain that drivers license fraud places on their 
state budgets. Since the passage of REAL ID. 
nearly every state has begun checking Social Secu- 
rity numbers and lawful status. Twice as many states 
require lawful presence today than two years ago. 
Furthermore, REAL ID’s one-driver-one-license rule 
enables states to prevent bad drivers from obtaining 
new licenses in other states and to stop criminals 
from evading the law by using multiple identities in 
one or more states. 

Myths About REAL ID 

Despite these benefits, REAL ID is subject to crit- 
icisms,^^ but these criticisms are based on widely 
perpetuated myths. 

Myth #1; REAL ID invades privacy. 

Fact: REAL ID protects privacy by ensuring that 
people are who they say they are. 

The information contained on the machine-read- 
able strip on the back of a REAL ID license is the 
same that most states require on the face of the 
license, such as a digital photo, name, permanent 
address, age, height, and weight. Thus, this infor- 
mation does not implicate privacy concerns. REAL 
ID licenses are not required to contain RFID (radio 
frequency identification) technology, biometric fin- 
gerprint information, or Social Security numbers, 
which could raise privacy concerns. 

Myth #2; REAL ID will create a national ID card and 
a hackable, national database. 

Fact; REAL ID does not collect personal data in a 
centralized federal database. 

REAL ID calls for the slates to operate and access 
secure databases that are queried by authorized par- 


22. National Commission on Terrorist Attacks Upon the United States, “9/1 1 and Terrorist Travel," August 21, 2004, p. 43, 
at htLp://govinfo.library.unt.edu/911/s[aJJ_stalements/91 JJteTrTrav_h4onograph.pdf (June 10, 2009). 

23. “Texas Attorney General Halts Sale of Fake Driver’s Licenses,” Government Technolog)\ April 1 1 , 2008, at 
hltp://www.goviech.com/gl/2859l4 (May 22, 2009). See also WEAL TV, “1-Team: Fake IDs Easy to Get for Immigrants.” 
July 30, 2007, at http://www.wbaitv.com/news/13784640/detail.html (May 21. 2009). 

24. Janice Kephari, "MD Faces Music on Drivers Licenses," Cemer for Immigration Studies, April 22. 2009, at 
hup://wwwcis.org/Kephart/MDHouseBilD87-REAUD (May 26, 2009). 

25. See Center for Democracy and Technology, “REAL ID: What Should Congress Do Now?” February I, 2008, at 
h(lp://www.cdt.org/sccuriiy/identU}’/20080201_REAL%20ID_hiHbrieJ.pdJ (May 26. 2009). 
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lies (such as MVAs and law enforcement). No data- 
bases are created to serve REAL ID, It only directs 
states to bring together pre-existing databases into a 
broader, secure network that will allow states to talk 
to one another and prevent fraud. Moreover, the 
federal government cannot and will not have access 
to any applicant’s information. There is nothing 
“national” about the process. If anything, REAL !D 
can be said to obviate any need for a national ID. 
Myth #3: REAL ID is a federal mandate that elimi- 
nates the right of states to issue driver’s licenses and 
identification. 

Fact: Each state can still issue many varieties of 
IDs, including IDs and driver’s licenses that do 
not comply with REAL ID. 

The driver’s license is the most common form of 
ID used in the U.S. today, A driver’s license is 
accepted for everything from opening a bank 
account to boarding a plane to picking up movie 
tickets purchased with a credit card. Securing this 
widely used credential makes sense on the state 
level, but not on the national level. Furthermore, 
the right to do this, even under REAL ID, still 
resides with the individual state. Each state can still 
issue many varieties of REAL ID-compliant cards 
and can continue to issue noncompliant IDs. The 
law remains completely voluntary, and states are not 
required to comply. Finally, REAL ID does not 
infringe on the right of states to decide who is eligi- 
ble for a driver’s license or ID. 

PASS ID Act: The Wrong Strategy 

PASS ID advocates portray the bill as a means of 
maintaining 9/1 1 Commission recommendations in 
a more flexible manner than offered by REAL ID. In 
reality, the PASS ID Act repeals outright substantive 
provisions of REAL ID, stripping away provisions 


that are already making driver’s license issuance 
more secure. In short, PASS ID would set the same 
standards for driver's licenses as was recommended 
by the Commission, but the standards will not 
ensure security 

The primary supporters of PASS ID have made 
their opposition to REAL ID clear and the PASS ID 
language demonstrates that their goal is to freeze 
standards as they are today instead of continuing to 
strengthen licensing under REAL ID. Specifically, 
PASS ID would: 

• Weaken identity verification. Two areas are key; 
ensuring that people are who they say they are 
(identity verification) and digitization of birth 
records to safeguard driver’s license issuance, 
PASS ID returns identity verification to identity 
validation, the pre-9/Il standard, in which the 
state could simply rubber-stamp documents, 
such as birth certificates, principal residency doc- 
uments, electronic verification of Social Security 
numbers, and passports. This was the same pro- 
cess that five 9/1 1 hijackers used to secure fake 
documents (principal residence affidavits) in Vir- 
ginia. which enabled them to obtain IDs in early 
August 2001. REAL ID combats this problem by 
adding passport verification and birth record dig- 
itization as additional layers of security^^ 

Lawful presence checks are only effective if 
identity verification and document authentica- 
tion (ensuring that documents used are valid 
and trustworthy) are sufficient. Absent sufficient 
verification, an applicant would only need to 
steal, borrow, or buy a legal immigrant’s or U.S, 
citizen’s identity use it to validate submitted 
paperwork, and then undergo a lawful presence 
screening, which is largely ineffective without 
the identity verification step. In essence, these 


26. Jame-S Jay Carafano, “Making REAL ID Real — Finally,” Heritage Foundation WcbMemo No. 1773, January 11, 2008, at 
hnp://wivw.heritage.org/Research/HomclandSei:urily/wm}773.cfm. 

27, PASS ID does maintain the lawful presence checks of REAL ID, which is an important standard for driver’s license security. 
Maryland recently began checking lawful presence, after finding that allowing illegal immigrants to obtain Maryland 
driver’s licemses had made the slate a magnet for fraud, crime, and bad drivers. Governor O’Malley, a co-chair of the National 
Governors Association’s Homeland Security Comraitiee. signed a bill to comply with REAL ID on May 8, 2009, Laura 
Smitherman, “O’Malley Signs Contentious New Laws,” The Baltimore Sun, May 8, 2009, at htcp.VAvww.baliimoresun.com/ 
neivs/local/poli[iai/bal-md.bilh08may08,0Ji908‘t8.story (May 26, 2009). See also Andy Green, ''O’Malley’s Position on Real 
ID,” The Salrimore Sun, March 31, 2009, hnp://webiogs.hillimoresun.com/news/local/po!itics/2009/03/ornalleys _po.\i£ion_on_ 
realjd.html (May 26, 2009). 
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requirements would further enable identity 
theft, instead of combating it like the require- 
ments of REAL ID. 

• Give slates money without accountability or 
fiscal responsibility. PASS ID gives grant money 
to states without any accountability or any 
requirement to comply with the PASS ID require- 
ments. In fact, PASS ID would not apply if a state 
law preempts the legislation. The bill would push 
back the compliance deadline another four years 
until 2017 (currently slates would be required to 
be in compliance for those younger than 50 by 
2014). Finally, even though most states already 
exceed PASS ID standards, it would not require 
states to demonstrate progress toward achieving 
the standards in exchange for the federal grants, 
which translates into essentially free money for 
states to use at their discretion. At a cost to U.S. 
taxpayers, the act also requires the federal gov- 
ernment to provide free access to states for lawful 
status databases checks, including checking 
Social Security number information. 

• Weaken airport security. Given that at least six 
hijackers used state-issued IDs or driver’s licenses 
at airport check-in counters on the morning of 
9/11, REAL ID requires passengers to present a 
secure ID before boarding a commercial airplane. 
PASS ID eliminates this provision, allowing any- 
one to board a commercial aircraft, whether or 
not they have a secure ID. 

• Eliminate information sharing among states. 
The 9/11 Commission also found that the 9/11 
hijackers held multiple driver’s licenses and IDs 
from multiple states, similar to bad drivers, drug 
runners, counterfeiters, and others trying to cir- 
cumvent the law. While REAL ID grants have 
been given to the states to create an information- 
sharing system to ensure that applicants no 
longer hold driver’s licenses from other states, 
PASS ID would end that program, replacing it 
with a demonstration project that would likely 
never produce a useable system. 


What the U.S. Should Do Instead 

Since 2005, opponents have made several 
attempts to chip away at REAL ID Act require- 
ments, and PASS ID is the latest such effort. Given 
the progress that has been made on REAL ID, 
Congress should: 

• Keep REAL ID. The REAL ID standards can be 
implemented in a manner that respects constitu- 
tionally guaranteed liberties and the principle of 
federalism, makes economic sense, better pro- 
tects the individual liberties and privacies of U.S. 
persons, and contributes to national security and 
public safety.^® Postponing or modifying imple- 
mentation confuses the work already in process 
and detracts from the underlying purpose of 
REAL ID: enhancing security of both the individ- 
ual and the nation. 

• Appropriate necessary funds to finish imple- 
menting REAL ID. To date, states have been 
allocated $129 million in grants. However, 
approximately $50 million of the funds appropri- 
ated for fiscal year (FY) 2009 remain unspent. 
Even though Congress doubled funding for Pf 
2009 to $100 million, it is generally recognized 
that these sums will not cover the costs of imple- 
menting REAL ID. Rather than repeal REAL ID, 
Congress should support the states by appropri- 
ating sufficient funding and spending the remain- 
ing funds as originally intended, 

• Move interested states into the REAL ID system. 
The supporters of the PASS ID Act have claimed 
that states are uninterested in REAL ID and that 
PASS ID represents a more palatable option. 
However, about 15 states have publicly sup- 
ported REAL ID and are working toward achiev- 
ing the first round of 18 material compliance 
benchmarks set by REAL ID regulations by the 
January 1, 2010, deadline. Other states con- 
tinue to make progress towards REAL ID goals. 
These benchmarks indicate progress toward 
REAL ID goals and include target goals, such as 


28. James jay Carafano, "Making REAL ID a Reality" 

29. Kephart, "Secretary Chenoff’s Stocking Sniffer." 

30. Janice Kephart, "REAL ID Final Rules: A Summary,” 9/11 Security Solutions. February 21. 2008, at 
hup://ww'w.9l hecuhlysoiutwns.com/docsi/REAlJDFinalRules.pdJ (May 26, 2009), 
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mandatory facial image capture, requiring appli- 
cants to sign applications under penalty of per- 
jury ensuring physical security of the ID cards, 
ensuring the security of personally identifiable 
information, verifying Social Security numbers 
and lawful status with federal database queries, 
and conducting background checks on covered 
MVA employees. Alabama, Colorado, Delaware, 
Florida, Indiana, Iowa, Kentucky, Maryland, 
Mississippi, Nevada, New Jersey, North Carolina, 
Ohio, Rhode Island, Texas, and Wisconsin 
should be deemed in material compliance as 
soon as practicable. Their successes will encour- 
age other states to follow suit.^^ 


• Add flexibility to the state grant program. 
Some states have chosen to increase the security 
of their IDs through enhanced driver’s license (EDL) 
memorandums of agreement with the DHS.^^ 
This program enables states to add additional 
information to drivers licenses to comply with the 
Western Hemisphere Travel Initiative (WHTl), 
which rolled out in full on June 1, 2009. WHTI 
requires a passport or “biometric equivalent" for 
any person, including U.S. citizens, to cross into 
the U.S. from Bermuda, the Caribbean. Mexico, 
or Canada. Several slates have successfully 
implemented EDLs, including Washington, New 
York, Vermont, and Michigan (as of late April 
2009).^^ Texas lawmakers have authorized the 
state government to begin issuing EDLs. but the 


governor has held back the process. The DHS 
should enable states that choose to implement an 
EDL program that complies with REAL ID stan- 
dards to use REAL ID grants for EDLs in addition 
to REAL IDs, producing a dual benefit. 

Secure IDs for a Safer America 

When a state issues a driver’s license or ID, both 
the state and the individual should be confident that 
the license is a secure, authenticated credential. The 
DHS issued final regulations for REAL ID in January 
2008, based on thousands of comments from states 
and other interested parties. Many states have 
already made significant progress toward this end. 
States are working toward implementation, spend- 
ing millions of dollars to improve their driver’s 
license issuing systems. 

Stopping those efforts now would simply waste 
money, confuse processes that took four years to put 
in place, and delay what most Americans want; 
secure IDs and a safer America. 

— -Janice L Kephart is a former counsel to the Sep- 
tember 11 Commission and is National Security Policy 
Director for the Center for Immigration Studies. Jena 
Baker McNeill is Policy Analyst for Homeland Security 
in the Douglas and Sarah Allison Center for Foreign 
Policy Studies, a division of the Kathryn and Shelby 
CuUom Davis Institute for International Studies, at The 
Heritage Foundation. 


31. U.S Department of Homeland Security, “Frequently Asked Questions; REAL ID," June 20, 2008, at 
hltp://www.6pintcrnaiionalcom/new<;/ccipy%20oj%20redl%20id%20gran(s%20faqs.pdf (May 29, 2(X)9), See ako American Financial 
Services Association. "The REAL ID Act; State Implementation & Effects," March 2009, p. 4, at hitps://www.afsaon\ine.org/ 
CMS/JHeREPOSITORY/The%20REAL%201D%20Act%20FinalpdJtMzy 26, 2009). For details on individual stales, see the 
Appendix. 

32. U.S. Department of Homeland Securiiy “Fact Sheet: Enhanced DriverX Licenses (EDL)," December 5, 2007, at 
hup://www.aila.org/conteni/dejauh.aspx?bc=]016\6715ll2053\26285\26297\22988 (May 26, 2009). 

33. Patrick Michels, “Enhanced Drivers’ License Eases Border Crossing for Washington State Residents," Government 
Technology, April 9, 2008, at h(tp://www.gonech.com/gi/279970?id=279970 (May 26, 2009), New York Department of Motor 
Vehicles, "Enhanced DMV Photo Documents for U.S. Citizens Who Are Residents of NYS,” at hitp://www.nysdmv.com/ 
edl-main.him (May 26, 2009); Vermont Department of Motor Vehicles. “EDL FAQs," updated March 1 2, 2009, at 
hltp://dmv.vermom.gov/documents/Mi&cellaneousDocuments/EDLFAQ.pdJ (May 26, 2009); and Sue Schroder, “Cross the 
Border with Michigan’s Enhanced Driver's License," MUve.com, May 10, 2009, at hnp://www.mlive.com/travel/mdex.ssJ/ 
2009/05/il_wasnt_exactly_the_borderhiml (June 10, 2009). 

34. Eliot Shapleigh, "Governor Perry Harms Border Security and Texas Businesses by Denying Enhanced Driver’s License 
Program,” January 31, 2008, at http://shapleigh.org/news/J527-govemor-perry-harms-border-security-and-texas-hus\nessei-hy- 
denymg-enhanced-driver-s-license-program (May 26, 2009). 
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APPENDIX 

STATE PARTICIPATION IN REAL ID 

Alabama. Citizens take computerized tests. Their records are captured electronically, and their digital 
photos are stored in a searchable database. Their names are automatically checked against national data- 
bases to confirm their identities and to ensure that they are legally entitled to licenses. 

Colorado. Colorado remains a leader in identify theft prevention. 

Delaware.^^Delaware is examining ways in which the state can move forward with REAL ID implementation. 

Florida. Florida received $1.2 million to partner with Mississippi, the lead hub state for pilot implemen- 
tation and verification testing. 

Indiana. Indiana received $1.2 million to partner with the lead hub state for pilot implementation and 
verification testing. “BMV Commissioner Ron Stiver said the new licenses will result in a total cost savings 
of $2.5 million during the six-year contract period. 

lowa."^*^ Iowa is planning to comply with REAL ID and is actively taking steps toward this goal. 

Kentucky. “FEMA awarded Kentucky an additional $4 million to help stale Department of Motor Vehicle 
Departments connect to state Vital Records Offices (VRO). The Commonwealth of Kentucky will enable 
state VROs to access the Electronic Verification of Vital Events hub (a web based portal) to verify birth 
and death record information of individuals applying for REAL ID driver’s licenses and identification 
cards, Kentucky will also use these funds to expand the scope of its REAL ID Pilot Project by comparing 
U.5, foreign born citizens applying for a REAL ID drivers license with the U.S. Department of State’s for- 
eign born citizen birth record information.”"*^ 

Maine. On June 3, 2009, Maine Governor John Baldacci vetoed a bill that would have stopped Maine 
from complying with REAL ID. He cited the fact that “Maine had become a target for unscrupulous indi- 
viduals looking to circumvent legal presence requirements in other slates,” as one of the reasons behind 
the veto. 

Maryland. Governor Martin O’Malley signed a bill to comply with REAL ID on May 8, 2009. 


35. Alabama Department of Public Safety, “States Special Report on States Special Compliance with PL 109-13, the REAL ID 
Law,” July 2008, 

36. Colorado Motor Vehicle Division ITAA IdentEvent, “One State’s Journey to REAL ID; The Impetus for Change,” 
PowerPoint presentation, October 17, 2007, at hlip://www.Uaa.org/upload/es/€vents/ideyem07/preier\talions/vecchi.pp!!i 
(May 26, 2009), 

37. Jennifer Cohan, “Federal Real ID Act Delaware Implementation Proposal,” PowerPoint file, Delaware Divnsion of Motor 
Vehicles, July 25, 2008, at htipJ/www.aamva.org/aamva/DocumentDisplayMspx?\d<^%7BDB0BD626-AD21-‘i4CA-9023- 
5B2F19D058CB%7D (May 26, 2009). 

38. Florida Department of Highway Safely and Motor Vehicles, “Real ID Ad— Frequently Asked Questions, " at 
hup://www.jlhsmv.gov/realid (May 26, 2009). 

39. Gina M. Scott, “Indiana Launches More Secure Drivers License,” Digital Communities, June 6, 2007, at 
http://mvw.govLech.com/dc/artides/124057 (May 26, 2009). 

-^0. Iowa Department of Transportation, “Real ID: Questions and Answers" February 20, 2008, at hnp://www.iowadol.gov/Mvd/ 
ods/realidpdj (May 26, 2009). 

41. U S- Department of Homeland Security, “Frequently Asked Questions: REAL ID.” 
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Mississippi. Mississippi received $17 million to become the lead state for verification hub requirements 
and development. 

Nevada. Nevada received $1.2 million to partner with the lead hub state for pilot implementation and 
verification testing. “Nevada citizens will have the option of obtaining a Real ID compliant driver’s license 
or identification card, or a standard Nevada driver’s license as issued loday.”'^^ 

Ohio. Ohio was the first state to request and receive an extension. “Ohio has no plans to oppose Real ID, 
At this time, we are going to have to review the final rules to make a determination, but we have been 
moving full steam ahead with the intent of implementing Real ID in Ohio.” 

Oregon. In 2007, Oregon Governor Ted Kulongonski issued an Executive Order which called for stricter 
driver’s license and identification card issuance standards. 

Rhode Island. “Governor Carcieri has indicated that he supports REAL ID implementation in Rhode 
Island. 

Wisconsin, Wisconsin received $1.2 million to partner with the lead hub state for pilot implementation 
and verification testing. “Under the 2007-2008 biennial budget provisions Wisconsin [will bel in full 
compliance with the federal Real ID law.”"^^ 


42. Nevada Department of Motor Vehicles, “The Real ID Act in Nevada,” at hitp.7/www,dmvnv.com/rea/id (May 26, 2009). 

See also Tim Doulin, “Rules for Driver’s Licenses Tightened,” The Columbus Dispatch, Januar>’ 12, 2008, at 
hUp://www.dispatch.comAive/conieniAocal^news/siories/2008/0l/}2/Secure_License.ART_ART_01-12-08_Al_Jl91b46Lhtml 
(May 26, 2009). 

43- Tim Doulin, “Rules for driver’s licenses tightened: Ohio plans to start stricter screening in 2010 to meet federal Real ID 
standards,” The Columbus Dispatch, January 12, 2008. at http://www.dispatch.comAi've/content/\ocal_news/stones/2008/01/l2/ 
Secure_License.ART_ART_0l-I2-08_A}_4191M6Lhtml (June 19. 2009). 

44. Office of the Governor of the Stale of Oregon. “Standards for Issuance of Oregon Drivers Licenses and Identification 
Cards," Executive Order No. 07-22, at htip://govemor.oregon.gov/Gov/pdf/€o0722.pdf Qune 1 1 , 2009). 

45. Rhode Island Division of Motor Vehicles, "Prepanng for REAL ID,” at http.'/Avww.dmv.ri.gov (May 26, 2009). 

46. Wisconsin Legislative Reference Bureau, “REAL ID,” Brief 08-3, March 2(K)8. at hap://www.legis.s[ate.wi.us/!rb/pubs/wb/ 
08wb3.pdf (May 29, 2009), 
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Introduction 

Good morning Chairman Lieberman, Ranking Member Collins, and members of the Committee. I am Dr, 
Nelson Ludlow, Director and Chief Executive Officer of Intellicheck Mobilisa, Inc. I am pleased to submit 
this testimony on S. 1261 Providing for Additional Security in States' Identification Act of 2009 (PASS ID 
Act) to the Senate Committee on Homeland Security and Governmental Affairs. 

Intellicheck Mobilisa, Inc. 

Intellicheck-Mobilisa Inc, (NYSE Amex:IDN) is a Historically Underutilized Business (HUB) Zone, veteran- 
owned, publicly traded, small business headquartered in Port Townsend, Washington with offices in 
Alexandria, Virginia and Woodbury, New York. In addition to our major office locations, we have 
employees in California, Georgia, New Hampshire and Ohio. 

intellicheck Mobilisa is a leader in the ID verification business, both for government entities and in the 
commercial sector. We have 3 main business units. (1 ) Government Identity Systems, (2) Commercial 
Identity Systems and (3) Wireless Programs. Both Identity Units focus on the processing of the 
information contained in the machine readable zone of drivers licenses. 

Intellicheck Mobilisa currently owns 9 patents and has 10 patents-pending in the area of scanning 
machine readable zones on driver's licenses, military ID cards, Transportation Worker Identity Cards and 
other valid forms of identification cards, intellicheck Mobilisa products include the Defense ID system, an 
advanced ID card access control product that is currently protecting over 70 military and federal locations 
and ID-CHECK, a technology that instantly reads, analyzes, and verifies encoded data in magnetic 
stripes and barcodes on government-issue IDs from approximately 60 jurisdictions in the U.S. and 
Canada to determine if the content and format are valid. 

Our ID technologies help: 

• Combat Commercial Fraud - which may lead to economic losses to merchants from check 
cashing, debit and credit card as well as other types of fraud, such as identity theft that principally 
uses fraudulent identification cards as proof of identity; 

• Facilitate Instant Credit Card Approval - retail stores use Intellicheck Mobilisa technology to scan 
a driver’s license at a kiosk or at the point of sale (POS) and send the information to a credit card 
underwriter to get instant approval for a private labeled credit card. This technique protects 
consumer data and is significantly more likely to result in a completed transaction compared to in- 
store personnel asking customers to fill out a paper form with the same information; 

• Prevent Unauthorized Access - our systems and software are designed to Increase security and 
deter terrorism at airports, shipping ports, rail and bus terminals, military installations, high profile 
buildings and infrastructure where security is a concern; 

• Deter Underage Access to Age Restricted Products and Services - our systems and software are 
designed to determine the customer’s age as well as the validity of the encoded format on 
identificalion documents, to detect and prevent the use of fraudulent identification for the 
purchase of alcohol, tobacco and other age restricted products and services and to reduce the 
risk to the retailer of substantial monetary fines, criminal penalties and the potential for license 
revocation for the sale of age-restricted products to under-age purchasers; 

• Avoid Inefficiencies Associated With Manual Data Entry - by reading encoded data contained in 
the bar code and magnetic stripe of an identification card, customers are capable of accurately 
and instantaneously inputting information into forms and applications without the errors 
associated with manual data entry; 

Government ID Systems 

Defense ID is the flagship product in protecting military bases and other secure facilities across the 
United States. Currently at use in over 70 federal installations including high visibility facilities such as 
Andrews Air Force Base (home to Air Force One), Defense ID has stopped over 60,000 suspect 
individuals from gaining access to these secure areas. 
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Defense ID is a mobile, hand-held device usually used by entry control point personnel that scans the 
machine readable code on military ID cards and driver’s licenses to compare the data to over 100 "bad 
guy” lists, including the FBI Most Wanted Fugitives, America's Most Wanted, and Interpol. 

After a terrorist plot was discovered and prevented at Fort Dix, New Jersey, the US military chose 
Defense ID as the system of choice to aid the security personnel in protecting that base. 

Defense ID is also used during large events open to the public. During an air show event in Maryland 
over 50,000 pieces of ID were scanned and 71 stops were made. 

Commercial ID Systems 

ID Check is used commercially in pharmacies, retail stores, hotels and banks. 

Pharmacies scan driver’s licenses to verify identity on a prescription and inventory controlled over-the- 
counter drug (e.g, Pseudoephedrine) purchases as required by current law. 

Currently used in 200 plus banks, the ID Check System Is used to check the identity of an individual 
applying for an account. By scanning an applicant’s driver's license, the data is input directly into the 
computer eliminating the need to photo copy the license. This helps eliminate data entry errors and 
reduces the chance of identity theft on new accounts. 

Retail giants Target, LL Bean, Toys R Us, Payless Shoes, and many more have implemented the ID 
System to allow customers the option of applying for a private labeled credit card when checking out at 
the cash register. Using the same barcode scanner that reads the prices on merchandise, the register 
operator can also scan the customer’s driver's license to automatically fill out the electronic application 
form. This process again helps eliminate data entry errors and reduces the chance of identity theft on new 
accounts. These retailers also use the driver’s licenses to prevent fraudulent returns. 

Intellicheck Mobilise also has a system that is in use in the hotel and car rental industries to aid in the 
check-in process in order to verify identity and reduce the registration time for hotel and car rentals. 

Nearly 60% of people entering a hotel for the evening do not have a reservation. Using a kiosk to scan 
their driver’s license, the customers can fill out the entire hotel application form in just a few seconds as 
opposed to standing at the front desk and waiting for the clerk to type in all of the required information. 

AAMVA Test Lab and Courtesy Verification Program 

Intellicheck Mobilisa was appointed by the American Association of Motor Vehicle Administrators 
(AAMVA) as the official testing laboratory for AAMVAnet, Inc., the technical arm of AAMVA and has 
provided conformity assessment testing services for AAMVA since November 1999. The AAMVA 
establishes guidelines for driver’s licenses and non-driver identification cards that contain encoded 
information on magnetic stripes and barcodes. 

Intellicheck Mobilise also supports AAMVA with providing their members with a Courtesy Verification 
Program (CVP). CVP is a free service provided to AAMVA members and is an effective way for AAMVA 
members to determine if their driver’s licenses and identification (DL/ID) cards and other motor vehicle 
administration documents using machine readable technologies conform to the applicable AAMVA 
standards and specifications. 

Even though AAMVA has published best practices, standards, and specifications covering DL/ID cards 
and the bar codes for other documents for years, inconsistencies in the implementation of those 
guidelines continue to occur. These inconsistencies adversely impact the interoperability that is the main 
goal of the AAMVA standards and specifications. A primary objective of the CVP is improving the 
consistency of implementation across all jurisdictions choosing to follow the AAMVA standard and 
specifications. Information gained from the testing of jurisdictions DL/ID cards and other documents is not 
only used by jurisdictions to improve their issuance systems but also is used by AAMVA to make 
improvements to the standards and specifications it publishes. 
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Current Challenges with Verifying identification Documents 

The high-tech revolution has created a major problem for those who rely on identification documents. In 
an age where scanners, computers and color printers are commonplace, fake IDs of the highest quality 
are easily obtainable from a number of locations including college campuses and from multiple sites on 
the Internet. These fakes appear so real, even law enforcement agencies have encountered difficulty 
distinguishing them from legally issued documents. Additionally, these high-tech devices have the ability 
to easily alter properly issued ID's. Therefore, anyone can gain access to a false identity that gives them 
the ability, in a commercial transaction, to present fake and stolen credit cards or checks that are 
supported by false identification. Additionally, starting with only a fraudulent driver’s license, an individual 
may be able to create multiple identities, commit fraud, purchase age restricted products such as alcohol 
and tobacco while underage, evade law enforcement and engage in other criminal activities, such as: 

• committing identity theft; 

• improperly boarding airplanes; 

• committing credit card, debit card and check cashing fraud; 

• unlawfully committing pharmacy fraud, including false narcotic prescriptions; 

• gaining entrance to high profile buildings, military installations and sensitive infrastructures, such 
as nuclear facilities; 

• illegally purchasing firearms; 

• committing employee fraud, including employee theft and payroll theft; 

• engaging in medical fraud; 

• obtaining welfare or other government benefits; and 

• committing refund fraud. 

In addition to these concerns, nearly 1 in 300 key strokes contain an error, which equates to nearly 1 in 2 
applications for new accounts, credit cards, loyalty Information, health care, hotel check in, hospitals, et 
cetera containing errors. Individuals are also 12 times more likely to feel comfortable and complete a new 
account application by scanning an ID card than writing their personal information on an application form. 

Given the ease with which identification can be falsified, simply looking at a driver’s license may not be 
sufficient to verify age or identity and determine whether or not it is fraudulent. This is at the center of 
what Intellicheok Mobilisa does - since merchants are facing significant economic losses due to these 
frauds, a document verification system that can accurately read the electronically stored information is 
needed. Intellicheck Mobilisa technology provides an analysis of the data contained on the encoded 
formats of these identification documents by reading and analyzing the encoded format on the magnetic 
stripe or bar code on the driver’s license and comparing It against known standards. Intellicheck Mobilisa 
is the leader in this capability and the only company capable of doing this for all national jurisdictions. 

S. 1261 the “Providing for Additional Security in States’ Identification Act of 2009” (PASS ID Act) 

While Intellicheck Mobilisa overall supports this legislation. Section 4 of the bill appears to prevent 
scanning of the Machine Readable Zone (MRZ) of a driver’s license or identity card by a private entity; 

SEC. 4. USE OF DRIVER'S LICENSE OR IDENTIFICATION CARD DATA BY PRIVATE 
ENTITIES. 

Chapter 123 of title 1 8, United States Code is amended — 

(1) in section 2722, by adding at the end the following: 

(c) Copying Information From Drivers Licenses or Identification Cards. — It shall be unlawful for 
any person, knowingly and without lawful authority — 

“( 1 ) to scan the information contained in the machine readable component of a driver's 
license or identification card: or 

"(2)(A) to resell, share or trade that information with any other third parties: 

"(B) track the use of a driver’s license or identification card: or 
"(C) store the information collected.": 
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As it is currently drafted, this section would prohibit retail stores, banks, hotels and car rental agencies 
from using Intellicheck Mobilisa technology to scan the MRZ of driver's licenses and identification cards 
for the purposes of issuing credit cards, opening bank accounts, checking in to hotels, renting cars, and 
for a host of other applications where technology has safely and securely facilitated the legitimate 
commercial interaction between citizens and businesses while protecting individuals’ privacy and identity 
security concerns. 

While we understand the intent of the drafters is to protect the privacy of the individual and to prevent the 
information from being collected and sold to third parties for the purpose marketing future products and 
services, there are a number of legitimate business transactions that do utilize this technology to improve 
accuracy of data input, prevent fraud and identity theft, and reduce transaction times. The way the 
language is currently drafted, it singles out and prohibits a specific technology and activity that has been 
conducted and accepted for more than 10 years. This language prohibits the scanning of the reverse side 
of the identification card or driver's license, but does not prohibit the use of optical character recognition 
technology (OCR) that could be used to scan the face of the card and, in effect, automatically capture all 
of the same information that is embedded in the MRZ. The language will have the effect of causing 
retailers to revert to the outdated method of having individuals fill out forms by hand and cashiers/hotel 
clerks/car rental agents/bank tellers populating fields in computerized data forms from those handwritten 
forms. This poses an additional identity theft risk as an individual’s information is now floating around on a 
piece of paper waiting to be filed or transmitted to the bank issuing the credit card. 

The MRZ is often considered the more secure location for information as the information can be 
encrypted. For the majority of states (37 out of 50), the information encoded in the MRZ is either the 
same or less than that on the face of the driver’s license. The most common "encoded but not printed" 
information is hair color and/or weight (6/1 3). Only two states specify race on a driver’s license, and only 
one has it in the MRZ. 

There are a handful of states that previously issued driver's licenses with social security number (SSN) 
information. In 2004, the Intelligence Reform Act prohibited the printing and encoding of the SSN on 
driver’s licenses/identification cards issued 1 year after enactment of the act (2005), Since this time, 
states that had been using the SSN on the document made efforts to have it removed. Most of these 
licenses have now been replaced by license renewals. Only Maine and West Virginia encode SSNs and 
that information is encrypted in the MRZ on both of those licenses. While most states put an end to the 
use of the SSN before or immediately after the passing of the act, a few states went as far as the year 
2008 before they removed the SSN. This would mean that there may be some documents in circulation 
as far as 2016 that would contain the SSN, However, there is no state that encoded an unencrypted SSN 
in the MRZ without it also being printed on the front of the driver’s license. 

For SSN and race, Intellicheck Mobilisa software filters out that information, blocking It from being 
transmitted to retailers and banks. The credit card application process requires the customer to manually 
enter their SSN on a separate numeric key pad for all states driver’s licenses, even if an older version of a 
driver’s license contained the SSN. 

Intellicheck Mobilisa does not, nor has it ever, collected data from the millions of MRZs scanned for 
commercial purposes each week. We support the prohibition to use the information parsed from the MRZ 
for any purpose other than the intended use when the owner of the license provides the license to be 
scanned. We do not, nor have we ever, sold or stored data for use by some third party not involved in the 
original interaction for which the document was read. 

Recommendations 

Intellicheck Mobilisa recommends changing the language in Section 4 to address the key privacy concern 
regarding the use of sensitive personal information on driver’s licenses and identification cards by 
prohibiting placing that information on the card itself. Rather than single out and prohibit a single 
technology we recommend addressing the privacy issue as recommended above, which makes Section 4 
no longer necessary or, in the least, amending Section 4 to more clearly address the privacy concern of 
unknowing use and collection of driver’s license information. The section can also be amended to 
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specifically prevent the misuse of information when that information is presented for age-verification 
purposes. We welcome the opportunity to help the committee unambiguously address these important 
privacy concerns while simultaneously preserving the ability for consumers and businesses to engage in 
safe, secure and mutually beneficial transactions as they have for more than a decade using our 
technology. 

Summary 

In conclusion, there are a number of legitimate business transactions that utilize technology to scan the 
Machine Readable Zone (MRZ) of driver's licenses to improve accuracy of data input, prevent against 
fraud and identity theft and reduce transaction times when applying for a credit card, renting a car, 
checking in to a hotel or opening a new bank account. This technology should not be banned in favor of 
technology to scan the front of the card via Optical Character Recognition (OCR) or reverting to the 
outdated method of having individuals fill out forms by hand. 

We appreciate the opportunity to provide this information to the Committee. Intellicheck Mobilisa is 
prepared to assist you in your efforts in any way we can and I would be happy to answer any questions 
you might have for me. 
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Statement for the Public Record 

The National Association for Public Health Statistics and Information Systems 
(NAPHSIS) welcomes the opportunity to provide this written statement for the public 
record as the Committee reevaluates the REAL ID Act. NAPHSIS represents the 57 vital 
records jurisdictions that collect, process, and issue birth and death records in the United 
States and its territories, including the 50 states. New York City, District of Columbia 
and the five territories. NAPHSIS coordinates the activities of the vital records 
jurisdictions among the jurisdictions and with federal agencies by developing standards, 
promoting consistent policies, working with federal partners, and providing technical 
assistance to the jurisdictions. 

The Birth of Verification 

Prior to the terrorist attacks on the United States on September 11, 2001, all but one of 
the terrorist hijackers acquired some form of identification document, some by fraud, and 
used these forms of identification to assist them in boarding commercial flights, renting 
cars, and other necessary activities leading up to the attacks. In its final report, The 9/1 1 
Commission recommended implementing more secure sources of identification, stating 
that “federal government should set standards for the issuance of birth certificates and 
sources of identification, such as driver's licenses. Fraud in identification documents is no 
longer just a problem of theft. At many entry points to vulnerable facilities, including 
gates for boarding aircraft, sources of identification are the last opportunity to ensure that 
people are who they say they are and to check whether they are terrorists.”' 

Heeding the recommendations of the 9/1 1 Commission, Congress enacted the REAL ID 
ACT in May 2005. Among other provisions, the REAL ID Act and its corresponding 
regulations (6 CFR Part 37) require that applicants for a driver’s license present their 
birth certificate to the motor vehicle agency to validate their U.S. citizenship and their 
date of birth, and that birth certificates must be verified by the state. Sec. 37.13 of the 
identification standards regulations recommends that states through their departments of 
motor vehicles (DMV) should use the Electronic Verification of Vital Events (EWE) 
system, operated by NAPHSIS, to verify birth certificates presented by applicants. 

EWE is an online system that verifies birth certificate information. It provides 
authorized users at participating agencies with a single interface to quickly, reliably, and 
securely validate birth and death information at any jurisdiction in the country. In so 
doing, no personal information is divulged to the person verifying information — EWE 
simply relays a message that there was or was not a match with the birth and death 
records maintained by the state, city, or territory. 


' The 9/t 1 Commission Report, Final Report of the National Commission on Terrorist Attacks upon the 
United States, July 2004, p. 390. 
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Birth Verification Needed Now More Than Ever 

Many federal and state agencies rely on birth certificates for proof of age, proof of 
citizenship, identification for employment purposes, to issue benefits or other documents 
(e.g. driver’s licenses. Social Security cards, and passports) and to assist in determining 
eligibility for public programs or benefits (e.g., Medicaid). Nevertheless, individuals have 
obtained birth certificates of deceased persons and assumed their identity, created 
fraudulent birth certificates, and altered the information on a birth certificate, as 
documented in a Department of Health and Human Services Office of Inspector General 
Report of 2000.^ 

Most recently, the GAO documented several cases in which investigators created 
fraudulent birth certificates and were able to obtain passports based upon the fraudulent 
records because the passport office did not verify the birth certificate information.^ As a 
result, the Passport Fraud Prevention Managers commenced using the EWE system in 
March 2009 for birth verifications. In their first six weeks of use, there were two 
instances where the Fraud Prevention Mangers used the EWE system to electronically 
verify the birth certificates, and EWE returned a ‘no match.’ Upon further follow up 
with the vital records offices that ‘issued’ the birth certificates it was determined that 
indeed the birth certificates presented with those passport applications were fraudulent. 

EVVE’s Benefits Hindered Only by Resource Constraints 

EWE is currently used by the state DMVs and Medicaid Offices, the Social Security 
Administration, the Office of Personnel Management, and the Department of State Fraud 
Prevention Managers in select jurisdictions (see Table 1). Users of EWE are enthusiastic 
about the system, citing its capacity for: 

• Providing protection against the potential use of birth certificates for fraudulent 
activities. 

• Improving customer service by facilitating rapid access to accurate and verifiable 
vital record data in real-time. 

• Safeguarding the confidentiality of birth and death data. 

. Offering a secure mechanism for communication between agencies and vital records 
offices via the Internet. 

• Easily integrating with current legacy systems that the federal or state agencies may 
already be using, and for serving as a user-friendly interface for agencies that seek a 
stand-alone query system. 

NAPHSIS is working on further upgrades to the EWE system to meet the REAL ID 
requirements and to ensure that EWE is installed in all 57 jurisdictions by May 201 1. 
NAPHSIS is also in the process of procuring a data analysis and quality control tool that 


^ Department of Health and Human Services, Office of Inspector General, Birth Certificate Fraud, Sept. 
2009 (OEI-07-99-00570). 

’ Government Accountability Office, Department of State: Undercover Tests Reveal Significant 
Vulnerabilities in State's Passport Issuance Process, Mar. 2009 (GAO-09-447). 
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all jurisdictions can utilize to analyze their EWE databases for anomalies, 
inconsistencies, accuracy, and completeness. 

Nevertheless, EWE faces resource-related challenges that may impact our ability to 
harness EWE’s full potential: 

• Most vital records jurisdictions have electronic birth records that extend back for 
several decades, and the utilization of the EWE system has proven that these 
databases can be used effectively. However, only 85 percent of birth records dating 
back to 1935 are available in electronic form. To recognize EWE’s full potential to 
protect our nation, 100 percent of birth certificates in 100 percent of jurisdictions 
should be in electronic form. In addition, some data should be re-keyed to improve 
quality. Currently, among the vital records jurisdictions participating in the American 
Association of Motor Vehicle Administrators (AAMVA) birth verification pilot, 
those jurisdictions that have not cleaned up their files are experiencing only a 90 
percent match rate. With clean data files, the match rates would exceed 95 percent. 

• There are cases where an individual has assumed a false identity by obtaining a birth 
certificate of a person who has died. Therefore, it is important that resources be 
provided so that all death records are electronically linked to birth records. Most 
jurisdictions have linked infant deaths, and in many cases linked deaths to persons 
under 45 years of age. In the cases where birth and death records are linked, EWE 
will return a “deceased” indicator to the requesting agency, which will confirm that 
the documentation presented is fraudulent. 

• NAPHSIS collects fees from EWE users to cover costs related to the system’s 
operation, such as technical support and maintenance, system and business operation 
support, and vital records jurisdiction fees to support EWE query access to birth 
data. DMV offices have expressed concerns about paying the costs associated with 
EWE, Providing federal funding to DMVs to cover these costs would increase 
EWE usage and help prevent the fraudulent use of birth information in acquiring 
driver’s licenses and identification cards. 

Investment in Birth Verification Required to Maximize Safety 

As you reevaluate the REAL ID Act and consider legislation to strengthen it, NAPHSIS 
recommends that you preserve the authority established in REAL ID that requires 
driver’s license applicants to present a birth certificate to document their birth in the 
Lfnited States and their date of birth. We also urge that states continue to be required to 
verify the birth certificates presented by these applicants, and that they use EWE to do 
so. 


To facilitate the implementation of EWE throughout the United States and to harness its 
full potential to safeguard the American people, we respectfully request that any new 
legislation authorize an annual appropriation of $15 million to underwrite the state DMV 
fees associated with verifying birth data. In addition, we request that you authorize an 
appropriation of $102.5 million over a two-year period for vital records jurisdictions to 
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digitize their birth data back to 1935, to clean these data to support electronic queries, and 
link birth and death records. NAPHSIS feels strongly that this is a small price to pay to 
help DMVs verify birth data on the 245 million driver’s licenses issued annually and to 
ultimately keep our country safe and secure. 

As Congress seeks to improve the REAL ID Act, it is important to consider the 
legislation’s intent: to preserve the safety of the American people. The 9/1 1 terrorists’ 
ability to obtain valid government issued IDs, and more recently, the GAO’s ability to 
obtain passports using fraudulent birth certificate data, reinforces the merits and 
importance of the REAL ID Act’s birth verification provisions. NAPHSIS urges that the 
Committee “do no harm” in reevaluating the REAL ID Act and ensure these provisions 
are preserved and strengthened in any new legislation. Indeed, Congress should use the 
REAL ID Act as a foundation on which to build a secure birth verification system. 

NAPHSIS appreciates the opportunity to submit this statement for the record and looks 
forward to working with the Committee as it reevaluates the REAL ID Act and seeks to 
strengthen its provisions. If you have questions about this statement, please do not 
hesitate to contact NAPHSIS Executive Director, Garland Land, at gland@naphsis.org or 
(301) 563-6001. You may also contact our Washington representative, Emily 
Holubowich, at eholubowich@,dc-crd.com or (202) 484-1 100. 

Table 1: EWE Users as of June 30, 2009 


Vital Records Jurisdictions ° 

Federal 

State 

Alabama Arkansas 

Connecticut Hawaii 

Iowa Kansas 

Kentucky Minnesota 

Mississippi Missouri 

Montana North Dakota 

Oklahoma South Dakota 

Utah 

Department of State, Fraud 
Prevention Managers 

Office of Personnel 
Management 

Social Security 
Administration 

Iowa DMV 

Minnesota Medicaid Office 
Mississippi Medicaid Office 
Mississippi District Health 

Offices 

North Dakota DMV 

South Dakota DMV 

South Dakota Medicaid Office 
Washington Medicaid Office 


‘ NAPHSIS expects to expand EWE online usage to the eight additional vital records jurisdictions before 
the end of calendar year 2009, including; California; Massachusetts; Michigan; New Jersey; New York 
City; Ohio; Oregon; and Pennsylvania. 
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93RD DISTRICT 

STATE CAPITOL 

P.O. BOX 30014 

LANSING, Ml 48909-7514 

PHONE: (517) 373-1778 

FAX: (517) 373-57S0 

E-MAIL: paii!opsommer@house.mi.gov 


MICHIGAN HOUSE OF REPRESENTATIVES 

Paul E. Opsommer 

STATE REPRESENTATIVE 


July 14, 2009 

The Seriate Committee on Homeland Security and Governmental Affairs 

The Honorable Joe Lieberman, Chairman 

340 Dirksen Senate Office Building 

Washington, DC 20510 

(202) 228-3792 Fax 

RE: written testimony for 7/15/09 hearing 

Dear Chairman Lieberman, Ranking Member Collins, and Honorable Committee Members: 

Thank you for receiving my written testimony for the July IS* hearing, “Identification Security: 
Reevaluating the REAL ID Act”. 

As Minority Chair for the Transportation Committee of a border state, I have had to deal first hand 
with many issues related to REAL ID, WHTl, Enhanced Driver’s Licenses (EDLs), passports, and 
other identity documents. While the many problems associated with Title II are well known, I wanted 
to offer my personal perspective on how any alternatives need to be evaluated. 

REAL ID. like EDLs and now potentially PASS ID. are at their core not about any one set of proposed 
or initial rules, but are about who is in charge of making additional rules in the future. While much 
attention has focused on what these laws would initially require, far too little time has been spent 
examining how they could be altered going forward. As an example, the “final” rules for REAL ID 
were really not final rules. In fact, in the “final” rules DHS mentioned several times that they could 
change technological standards later by merely consulting with the states and holding public 
comments. Subsequent conversations with DHS made clear that they could also change biometric 
standards, data sharing criteria, or the list of recognized federal purposes at any time in the future 
without needing a new law or going back to Congress. 

That is unacceptable, regardless what the initial rules may be or who is paying for the program. 

In short, REAL ID was not a finite rule making process, but rather a blank check that permanently put 
DHS, or their agent AAMVA (through the Drivers License Agreement), in total ongoing control. 

While this is not desirable for a State’s sovereign documents regardless of their relationship with DHS, 
it is compounded by my first hand experience with DHS over EDLs that has been almost universally 
negative. Recent communication has improved, but DHS is still not flexible in regards to standards 
and regulations that are often ill-advised and even counter to Congressional intent. Getting reliable 
data, even through FOIA, has been difficult. 
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If PASS ID shares this same characteristic, and permanently puts DHS, AAMVA, or other designees in 
charge of evolving standards in the future, all it serves to do is to limit the initial changes to make the 
law more palatable until such time it can 1::^ changed in the future. 

I would appreciate your willingness to discuss this issue with DHS at the hearing, and to also take 
steps to first truly abolish Title II of the REAL ID Act so that any alternative can be put together in a 
fresh manner that changes both the role of DHS and the finiteness of any rule making process. Trying 
to “fix” REAL ID while leaving its core intact will ultimately leave us with many of the same issues 
and concerns, regardless of who pays for it. 

Thank you for your kind consideration, 

Respectfully in service. 



State Representative 
93'^‘‘ District 


O 
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